├── examples
    ├── crypttab
    ├── generate-cred.sh
    └── generate-hmac-secret.sh
├── Makefile
├── NEWS
├── initramfs-hook
├── README.md
├── keyscript.sh
└── LICENSE


/examples/crypttab:
--------------------------------------------------------------------------------
1 | # In order to use fido2luks add 'keyscript=/usr/lib/fido2luks/keyscript.sh'
2 | # and run update-initramfs -u
3 | 
4 | <device>_crypt UUID=<LUKS-VOLUME-UUID> none luks,keyscript=/usr/lib/fido2luks/keyscript.sh
5 | 


--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
 1 | build:
 2 | 	@echo "Run 'make install' to install fido2luks"
 3 | 
 4 | clean:
 5 | 	@echo "Nothing to do"
 6 | 
 7 | install:
 8 | 	install -D -m 0755 keyscript.sh $(DESTDIR)/usr/lib/fido2luks/keyscript.sh
 9 | 	install -D -m 0755 initramfs-hook $(DESTDIR)/etc/initramfs-tools/hooks/fido2luks
10 | 


--------------------------------------------------------------------------------
/NEWS:
--------------------------------------------------------------------------------
 1 | 0.0.3 (22 Aug 2025)
 2 | ===================
 3 | - Added support for FIDO2 user verification (UV).
 4 | 
 5 | 0.0.2 (05 Aug 2025)
 6 | ===================
 7 | - Added support for multiple tokens. fido2luks will now try all
 8 |   credentials in the LUKS header until it finds one that works with
 9 |   the inserted token.
10 | 
11 | 0.0.1 (13 May 2024)
12 | ===================
13 | - Initial release.
14 | 


--------------------------------------------------------------------------------
/initramfs-hook:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | PREREQ=""
 4 | 
 5 | prereqs() {
 6 |         echo "$PREREQ"
 7 | }
 8 | 
 9 | case "$1" in
10 |         prereqs)
11 |                 prereqs
12 |                 exit 0
13 |         ;;
14 | esac
15 | 
16 | . "${CONFDIR}/initramfs.conf"
17 | . /usr/share/initramfs-tools/hook-functions
18 | 
19 | copy_exec /usr/bin/fido2-assert
20 | copy_exec /usr/bin/fido2-token
21 | copy_exec /usr/bin/jq
22 | 


--------------------------------------------------------------------------------
/examples/generate-cred.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | set -eu
 4 | 
 5 | RELYING_PARTY_ID="org.test.some_app"
 6 | USER_NAME="User Name"
 7 | USER_ID="User ID"
 8 | CLIENT_DATA="" # This can be empty
 9 | 
10 | FIDO2_DEVICE=$(fido2-token -L | head -n 1 | cut -d : -f 1)
11 | 
12 | if [ -z "$FIDO2_DEVICE" ]; then
13 |     echo "ERROR: no FIDO2 device found"
14 |     exit 1
15 | fi
16 | 
17 | CRED_PARAMS="$(mktemp /tmp/cred-params.XXXXXX)"
18 | CRED_DATA="$(mktemp /tmp/cred-data.XXXXXX)"
19 | CRED_VERIFY="$(mktemp /tmp/cred-verify.XXXXXX)"
20 | trap "rm -f $CRED_PARAMS $CRED_DATA $CRED_VERIFY" INT EXIT
21 | 
22 | printf "%s\n%s\n%s\n%s\n" \
23 |        $(echo -n "$CLIENT_DATA" | openssl sha256 -binary | base64) \
24 |        "$RELYING_PARTY_ID" \
25 |        "$USER_NAME" \
26 |        $(echo -n "$USER_ID" | openssl sha256 -binary | base64) > "$CRED_PARAMS"
27 | 
28 | fido2-cred -M -h -i "$CRED_PARAMS" -o "$CRED_DATA" "$FIDO2_DEVICE"
29 | fido2-cred -V -h -i "$CRED_DATA" -o "$CRED_VERIFY"
30 | 
31 | CRED_ID=$(head -n 1 "$CRED_VERIFY")
32 | 
33 | echo "A new credential has been generated"
34 | echo "ID: $CRED_ID"
35 | echo "Public key:"
36 | tail -n +2 "$CRED_VERIFY"
37 | 


--------------------------------------------------------------------------------
/examples/generate-hmac-secret.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -eu
 4 | 
 5 | # Set CREDENTIAL_ID and PUBLIC_KEY to the values that you got
 6 | # from generate-cred.sh, otherwise this won't work
 7 | 
 8 | RELYING_PARTY_ID="org.test.some_app"
 9 | CREDENTIAL_ID="E2NDqozxIGOlcUhlrg6+XIjZSRC8i5C69PgOiHzWXGBZTJ6No9fa6fEcPvQjxL5slKGVr7ioYBcxKwPREJnuMA=="
10 | SALT="The HMAC secret depends on this value"
11 | CLIENT_DATA="" # This can be empty
12 | 
13 | # Set these to true or false
14 | REQUIRE_PIN=false
15 | REQUIRE_USER_PRESENCE=true
16 | 
17 | # The public key is only needed to verify the result, see below
18 | PUBLIC_KEY='
19 | -----BEGIN PUBLIC KEY-----
20 | MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjX1Eiv/1H39f+b+MmSTymbdR8l3+
21 | GqJHf3X0CyREljyHi7mS5LgkmsyvO0fgc6SryYCUKG6MREdnKirNilXLYQ==
22 | -----END PUBLIC KEY-----
23 | '
24 | 
25 | FIDO2_DEVICE=$(fido2-token -L | head -n 1 | cut -d : -f 1)
26 | 
27 | if [ -z "$FIDO2_DEVICE" ]; then
28 |     echo "ERROR: no FIDO2 device found"
29 |     exit 1
30 | fi
31 | 
32 | ASSERT_PARAMS="$(mktemp /tmp/cred-params.XXXXXX)"
33 | ASSERT_DATA="$(mktemp /tmp/cred-data.XXXXXX)"
34 | trap "rm -f $ASSERT_PARAMS $ASSERT_DATA" INT EXIT
35 | 
36 | printf "%s\n%s\n%s\n%s\n" \
37 |        $(echo -n "$CLIENT_DATA" | openssl sha256 -binary | base64) \
38 |        "$RELYING_PARTY_ID" \
39 |        "$CREDENTIAL_ID" \
40 |        $(echo -n "$SALT" | openssl sha256 -binary | base64) > "$ASSERT_PARAMS"
41 | 
42 | fido2-assert -G -h \
43 |    -t up="$REQUIRE_USER_PRESENCE" -t pin="$REQUIRE_PIN" \
44 |    -i "$ASSERT_PARAMS" -o "$ASSERT_DATA" "$FIDO2_DEVICE"
45 | 
46 | # If you want to verify the result with the public key:
47 | # fido2-assert -V -h -i "$ASSERT_DATA" <(echo "$PUBLIC_KEY") es256
48 | 
49 | HMAC_SECRET="$(tail -n 1 "$ASSERT_DATA")"
50 | echo "The generated secret is $HMAC_SECRET"
51 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # fido2luks
 2 | 
 3 | This is an initramfs-tools extension to unlock LUKS-encrypted
 4 | volumes at boot time using a FIDO2 token (YubiKey, Nitrokey, ...).
 5 | 
 6 | `fido2luks` is designed for scenarios where a FIDO2 token has been
 7 | enrolled into a LUKS volume using `systemd-cryptenroll --fido2-device`,
 8 | but systemd itself is not used in the initramfs.
 9 | 
10 | This has been successfully tested with Debian bookworm and trixie.
11 | 
12 | ## Installation
13 | 
14 | Here's how to install `fido2luks` if it's not already available on
15 | your distro:
16 | 
17 | - Dependencies: you need `initramfs-tools`, `fido2-tools` and `jq` on
18 |   your system.
19 | 
20 | - Install `fido2luks` using one of these options:
21 |   - Download a `.deb` package from the GitHub
22 |     [releases](https://github.com/bertogg/fido2luks/releases) page.
23 |   - Build your own package using the provided scripts by running
24 |     `fakeroot debian/rules binary`.
25 |   - Simply run `make install` (this won't generate or install any
26 |     `.deb` package).
27 | 
28 | ## How to use it
29 | 
30 | - ⚠️ **Warning**: this can render your system unbootable, so make sure
31 |   that you have a backup of your files or a working initramfs that you
32 |   can use as a fallback in case things go wrong.
33 | 
34 | - Enroll your FIDO2 token into the LUKS volume, for example:
35 |   - `systemd-cryptenroll --fido2-device=auto --fido2-with-client-pin=true --fido2-with-user-presence=true /dev/XXX`
36 |   - After that, if you run `cryptsetup luksDump /dev/XXX` you should be
37 |     able to see the `systemd-fido2` token data.
38 | 
39 | - Edit `/etc/crypttab` and add `keyscript=/usr/lib/fido2luks/keyscript.sh`
40 |   to the options of the volume that you want to unlock.
41 | 
42 | - Generate a new initramfs with `update-initramfs -u`.
43 | 
44 | That's it. Next time you boot the system `fido2luks` should detect if
45 | your FIDO2 token is inserted and use it to unlock the LUKS volume. If
46 | the token is not detected then it will fall back to using a regular
47 | passphrase as usual.
48 | 
49 | If you have multiple tokens you can enroll all of them, and
50 | `fido2luks` will detect which one to use at boot time.
51 | 
52 | If the token is connected but not detected during boot make sure that
53 | the initramfs contains the necessary drivers. Check your
54 | `initramfs.conf` and set `MODULES=most` or add the necessary modules
55 | manually.
56 | 
57 | ## How this works
58 | 
59 | If you are not interested in the technical details you can skip this
60 | section.
61 | 
62 | When systemd enrolls a FIDO2 token into a LUKS volume it uses an
63 | extension called hmac-secret, supported by many hardware tokens.
64 | 
65 | In a nutshell, the token calculates an HMAC using a secret that never
66 | leaves the device and a salt provided by the user. The result is sent
67 | back to the user and is used to unlock the LUKS volume.
68 | 
69 | Since nothing is stored on the hardware token itself the user needs to
70 | provide some data that is kept on the LUKS header:
71 | 
72 | - A credential ID (previously generated during the enrollment process).
73 | - A _relying party_ ID (`io.systemd.cryptsetup` in this case).
74 | - The aforementioned salt (which should be random and different for
75 |   each LUKS volume).
76 | - Some settings such as whether to require a PIN or presence
77 |   verification (usually physically touching the USB key).
78 | 
79 | Check out the scripts in the examples/ directory to see how to
80 | generate your own credentials and secrets. See also the
81 | `fido2-cred(1)` and `fido2-assert(1)` manpages for more details.
82 | 
83 | ## Credits and license
84 | 
85 | fido2luks was written by Alberto Garcia.
86 | 
87 | This program is free software; you can redistribute it and/or modify
88 | it under the terms of the GNU General Public License as published by
89 | the Free Software Foundation; either version 2 of the License, or (at
90 | your option) any later version.
91 | 


--------------------------------------------------------------------------------
/keyscript.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/sh
  2 | 
  3 | # Copyright (C) 2024-2025 Alberto Garcia <berto@igalia.com>
  4 | # SPDX-License-Identifier: GPL-2.0-or-later
  5 | 
  6 | cleanup () {
  7 |     rm -f "$ASSERT_PARAMS" "$LUKS_TOKEN" "$LUKS_TOKEN_LIST"
  8 | }
  9 | 
 10 | ASSERT_PARAMS=$(mktemp -t params.XXXXXX)
 11 | LUKS_TOKEN_LIST=$(mktemp -t tokenlist.XXXXXX)
 12 | LUKS_TOKEN=$(mktemp -t token.XXXXXX)
 13 | trap cleanup INT EXIT
 14 | 
 15 | try_fido2_unlock () {
 16 |     # Get all tokens from the LUKS header with FIDO2 credentials.
 17 |     # Sort the array, placing entries with "fido2-uv-required: true" at the end.
 18 |     if ! cryptsetup luksDump --dump-json-metadata "$CRYPTTAB_SOURCE" | \
 19 |             jq -e '[.tokens[] | select(."fido2-credential" != null)] | sort_by(."fido2-uv-required")' > "$LUKS_TOKEN_LIST"; then
 20 |         echo "*** Error reading LUKS header in $CRYPTTAB_SOURCE" >&2
 21 |         return 1
 22 |     fi
 23 | 
 24 |     # Count how many tokens we have.
 25 |     NTOKENS=$(jq length "$LUKS_TOKEN_LIST")
 26 |     if [ -z "$NTOKENS" ] || [ "$NTOKENS" = "0" ]; then
 27 |         echo "*** No FIDO2 credentials found in $CRYPTTAB_SOURCE" >&2
 28 |         return 1
 29 |     fi
 30 | 
 31 |     # Check if the FIDO2 authenticator is inserted
 32 |     echo "*** Waiting for a FIDO2 authenticator..." >&2
 33 |     for _f in $(seq 5); do
 34 |         FIDO2_AUTHENTICATOR=$(fido2-token -L)
 35 |         sleep 1
 36 |         [ -n "$FIDO2_AUTHENTICATOR" ] && break
 37 |     done
 38 | 
 39 |     if [ -z "$FIDO2_AUTHENTICATOR" ]; then
 40 |         echo "*** No FIDO2 authenticator found" >&2
 41 |         return 1
 42 |     fi
 43 | 
 44 |     echo "*** Found FIDO2 authenticator $FIDO2_AUTHENTICATOR" >&2
 45 |     FIDO2_DEV=${FIDO2_AUTHENTICATOR%%:*}
 46 | 
 47 |     # Look for a credential that is valid for the inserted FIDO2
 48 |     # authenticator. For that we try to get an assertion from the
 49 |     # device, with 'up' and 'pin' set to false, so it requires no user
 50 |     # interaction.
 51 |     for i in $(seq "$NTOKENS"); do
 52 |         jq ".[$i-1]" "$LUKS_TOKEN_LIST" > "$LUKS_TOKEN"
 53 |         jq -r '"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
 54 |                ."fido2-rp",
 55 |                ."fido2-credential",
 56 |                ."fido2-salt"' "$LUKS_TOKEN" > "$ASSERT_PARAMS"
 57 |         REQ_UV=$(jq -r '."fido2-uv-required"' "$LUKS_TOKEN")
 58 |         # If a credential has the 'uv' option set then unfortunately
 59 |         # we cannot check if it's valid for the inserted FIDO2
 60 |         # authenticator without requiring user interaction.
 61 |         # So this is what we do:
 62 |         # - The array of credentials is sorted, those that require UV
 63 |         #   are at the end.
 64 |         # - All credentials that don't require UV are tested first,
 65 |         #   we can do that silently with the fido2-assert call.
 66 |         # - Once we find a credential that requires UV we assume
 67 |         #   that we can use it with the inserted authenticator.
 68 |         # - Not all authenticators support 'uv' so pass '-t uv' only
 69 |         #   when needed using the UV_OPT variable.
 70 |         if [ "$REQ_UV" = "true" ]; then
 71 |             UV_OPT="-t uv=true"
 72 |             break
 73 |         else
 74 |             UV_OPT=""
 75 |             if fido2-assert -G -t up=false -t pin=false -i "$ASSERT_PARAMS" \
 76 |                             -o /dev/null "$FIDO2_DEV" 2> /dev/null; then
 77 |                 break
 78 |             fi
 79 |         fi
 80 |         rm -f "$LUKS_TOKEN" "$ASSERT_PARAMS"
 81 |     done
 82 | 
 83 |     if [ ! -f "$LUKS_TOKEN" ] || [ ! -f "$ASSERT_PARAMS" ]; then
 84 |         echo "*** No valid credential found for this FIDO2 authenticator" >&2
 85 |         return 1
 86 |     fi
 87 | 
 88 |     # Now that we have a valid credential use it to compute the
 89 |     # hmac-secret, which is what unlocks the LUKS volume.
 90 |     REQ_PIN=$(jq -r '."fido2-clientPin-required"' "$LUKS_TOKEN")
 91 |     REQ_UP=$(jq -r '."fido2-up-required"' "$LUKS_TOKEN")
 92 | 
 93 |     if [ "$REQ_PIN" = "true" ]; then
 94 |         stty -echo
 95 |     fi
 96 | 
 97 |     SECRET=$(fido2-assert -G -h -t up="$REQ_UP" -t pin="$REQ_PIN" $UV_OPT \
 98 |                           -i "$ASSERT_PARAMS" "$FIDO2_DEV" | tail -n 1)
 99 | 
100 |     if [ "$REQ_PIN" = "true" ]; then
101 |         stty echo
102 |     fi
103 | 
104 |     if [ -z "$SECRET" ]; then
105 |         echo "*** Error obtaining secret from $FIDO2_DEV" >&2
106 |         return 1
107 |     fi
108 | 
109 |     echo >&2
110 |     printf "%s" "$SECRET"
111 |     return 0
112 | }
113 | 
114 | # Main execution
115 | if try_fido2_unlock; then
116 |     exit 0
117 | fi
118 | 
119 | echo "*** Unlocking $CRYPTTAB_NAME using a regular passphrase" >&2
120 | /usr/lib/cryptsetup/askpass "Enter passphrase: "
121 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                     GNU GENERAL PUBLIC LICENSE
  2 |                        Version 2, June 1991
  3 | 
  4 |  Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
  5 |  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  6 |  Everyone is permitted to copy and distribute verbatim copies
  7 |  of this license document, but changing it is not allowed.
  8 | 
  9 |                             Preamble
 10 | 
 11 |   The licenses for most software are designed to take away your
 12 | freedom to share and change it.  By contrast, the GNU General Public
 13 | License is intended to guarantee your freedom to share and change free
 14 | software--to make sure the software is free for all its users.  This
 15 | General Public License applies to most of the Free Software
 16 | Foundation's software and to any other program whose authors commit to
 17 | using it.  (Some other Free Software Foundation software is covered by
 18 | the GNU Lesser General Public License instead.)  You can apply it to
 19 | your programs, too.
 20 | 
 21 |   When we speak of free software, we are referring to freedom, not
 22 | price.  Our General Public Licenses are designed to make sure that you
 23 | have the freedom to distribute copies of free software (and charge for
 24 | this service if you wish), that you receive source code or can get it
 25 | if you want it, that you can change the software or use pieces of it
 26 | in new free programs; and that you know you can do these things.
 27 | 
 28 |   To protect your rights, we need to make restrictions that forbid
 29 | anyone to deny you these rights or to ask you to surrender the rights.
 30 | These restrictions translate to certain responsibilities for you if you
 31 | distribute copies of the software, or if you modify it.
 32 | 
 33 |   For example, if you distribute copies of such a program, whether
 34 | gratis or for a fee, you must give the recipients all the rights that
 35 | you have.  You must make sure that they, too, receive or can get the
 36 | source code.  And you must show them these terms so they know their
 37 | rights.
 38 | 
 39 |   We protect your rights with two steps: (1) copyright the software, and
 40 | (2) offer you this license which gives you legal permission to copy,
 41 | distribute and/or modify the software.
 42 | 
 43 |   Also, for each author's protection and ours, we want to make certain
 44 | that everyone understands that there is no warranty for this free
 45 | software.  If the software is modified by someone else and passed on, we
 46 | want its recipients to know that what they have is not the original, so
 47 | that any problems introduced by others will not reflect on the original
 48 | authors' reputations.
 49 | 
 50 |   Finally, any free program is threatened constantly by software
 51 | patents.  We wish to avoid the danger that redistributors of a free
 52 | program will individually obtain patent licenses, in effect making the
 53 | program proprietary.  To prevent this, we have made it clear that any
 54 | patent must be licensed for everyone's free use or not licensed at all.
 55 | 
 56 |   The precise terms and conditions for copying, distribution and
 57 | modification follow.
 58 | 
 59 |                     GNU GENERAL PUBLIC LICENSE
 60 |    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 61 | 
 62 |   0. This License applies to any program or other work which contains
 63 | a notice placed by the copyright holder saying it may be distributed
 64 | under the terms of this General Public License.  The "Program", below,
 65 | refers to any such program or work, and a "work based on the Program"
 66 | means either the Program or any derivative work under copyright law:
 67 | that is to say, a work containing the Program or a portion of it,
 68 | either verbatim or with modifications and/or translated into another
 69 | language.  (Hereinafter, translation is included without limitation in
 70 | the term "modification".)  Each licensee is addressed as "you".
 71 | 
 72 | Activities other than copying, distribution and modification are not
 73 | covered by this License; they are outside its scope.  The act of
 74 | running the Program is not restricted, and the output from the Program
 75 | is covered only if its contents constitute a work based on the
 76 | Program (independent of having been made by running the Program).
 77 | Whether that is true depends on what the Program does.
 78 | 
 79 |   1. You may copy and distribute verbatim copies of the Program's
 80 | source code as you receive it, in any medium, provided that you
 81 | conspicuously and appropriately publish on each copy an appropriate
 82 | copyright notice and disclaimer of warranty; keep intact all the
 83 | notices that refer to this License and to the absence of any warranty;
 84 | and give any other recipients of the Program a copy of this License
 85 | along with the Program.
 86 | 
 87 | You may charge a fee for the physical act of transferring a copy, and
 88 | you may at your option offer warranty protection in exchange for a fee.
 89 | 
 90 |   2. You may modify your copy or copies of the Program or any portion
 91 | of it, thus forming a work based on the Program, and copy and
 92 | distribute such modifications or work under the terms of Section 1
 93 | above, provided that you also meet all of these conditions:
 94 | 
 95 |     a) You must cause the modified files to carry prominent notices
 96 |     stating that you changed the files and the date of any change.
 97 | 
 98 |     b) You must cause any work that you distribute or publish, that in
 99 |     whole or in part contains or is derived from the Program or any
100 |     part thereof, to be licensed as a whole at no charge to all third
101 |     parties under the terms of this License.
102 | 
103 |     c) If the modified program normally reads commands interactively
104 |     when run, you must cause it, when started running for such
105 |     interactive use in the most ordinary way, to print or display an
106 |     announcement including an appropriate copyright notice and a
107 |     notice that there is no warranty (or else, saying that you provide
108 |     a warranty) and that users may redistribute the program under
109 |     these conditions, and telling the user how to view a copy of this
110 |     License.  (Exception: if the Program itself is interactive but
111 |     does not normally print such an announcement, your work based on
112 |     the Program is not required to print an announcement.)
113 | 
114 | These requirements apply to the modified work as a whole.  If
115 | identifiable sections of that work are not derived from the Program,
116 | and can be reasonably considered independent and separate works in
117 | themselves, then this License, and its terms, do not apply to those
118 | sections when you distribute them as separate works.  But when you
119 | distribute the same sections as part of a whole which is a work based
120 | on the Program, the distribution of the whole must be on the terms of
121 | this License, whose permissions for other licensees extend to the
122 | entire whole, and thus to each and every part regardless of who wrote it.
123 | 
124 | Thus, it is not the intent of this section to claim rights or contest
125 | your rights to work written entirely by you; rather, the intent is to
126 | exercise the right to control the distribution of derivative or
127 | collective works based on the Program.
128 | 
129 | In addition, mere aggregation of another work not based on the Program
130 | with the Program (or with a work based on the Program) on a volume of
131 | a storage or distribution medium does not bring the other work under
132 | the scope of this License.
133 | 
134 |   3. You may copy and distribute the Program (or a work based on it,
135 | under Section 2) in object code or executable form under the terms of
136 | Sections 1 and 2 above provided that you also do one of the following:
137 | 
138 |     a) Accompany it with the complete corresponding machine-readable
139 |     source code, which must be distributed under the terms of Sections
140 |     1 and 2 above on a medium customarily used for software interchange; or,
141 | 
142 |     b) Accompany it with a written offer, valid for at least three
143 |     years, to give any third party, for a charge no more than your
144 |     cost of physically performing source distribution, a complete
145 |     machine-readable copy of the corresponding source code, to be
146 |     distributed under the terms of Sections 1 and 2 above on a medium
147 |     customarily used for software interchange; or,
148 | 
149 |     c) Accompany it with the information you received as to the offer
150 |     to distribute corresponding source code.  (This alternative is
151 |     allowed only for noncommercial distribution and only if you
152 |     received the program in object code or executable form with such
153 |     an offer, in accord with Subsection b above.)
154 | 
155 | The source code for a work means the preferred form of the work for
156 | making modifications to it.  For an executable work, complete source
157 | code means all the source code for all modules it contains, plus any
158 | associated interface definition files, plus the scripts used to
159 | control compilation and installation of the executable.  However, as a
160 | special exception, the source code distributed need not include
161 | anything that is normally distributed (in either source or binary
162 | form) with the major components (compiler, kernel, and so on) of the
163 | operating system on which the executable runs, unless that component
164 | itself accompanies the executable.
165 | 
166 | If distribution of executable or object code is made by offering
167 | access to copy from a designated place, then offering equivalent
168 | access to copy the source code from the same place counts as
169 | distribution of the source code, even though third parties are not
170 | compelled to copy the source along with the object code.
171 | 
172 |   4. You may not copy, modify, sublicense, or distribute the Program
173 | except as expressly provided under this License.  Any attempt
174 | otherwise to copy, modify, sublicense or distribute the Program is
175 | void, and will automatically terminate your rights under this License.
176 | However, parties who have received copies, or rights, from you under
177 | this License will not have their licenses terminated so long as such
178 | parties remain in full compliance.
179 | 
180 |   5. You are not required to accept this License, since you have not
181 | signed it.  However, nothing else grants you permission to modify or
182 | distribute the Program or its derivative works.  These actions are
183 | prohibited by law if you do not accept this License.  Therefore, by
184 | modifying or distributing the Program (or any work based on the
185 | Program), you indicate your acceptance of this License to do so, and
186 | all its terms and conditions for copying, distributing or modifying
187 | the Program or works based on it.
188 | 
189 |   6. Each time you redistribute the Program (or any work based on the
190 | Program), the recipient automatically receives a license from the
191 | original licensor to copy, distribute or modify the Program subject to
192 | these terms and conditions.  You may not impose any further
193 | restrictions on the recipients' exercise of the rights granted herein.
194 | You are not responsible for enforcing compliance by third parties to
195 | this License.
196 | 
197 |   7. If, as a consequence of a court judgment or allegation of patent
198 | infringement or for any other reason (not limited to patent issues),
199 | conditions are imposed on you (whether by court order, agreement or
200 | otherwise) that contradict the conditions of this License, they do not
201 | excuse you from the conditions of this License.  If you cannot
202 | distribute so as to satisfy simultaneously your obligations under this
203 | License and any other pertinent obligations, then as a consequence you
204 | may not distribute the Program at all.  For example, if a patent
205 | license would not permit royalty-free redistribution of the Program by
206 | all those who receive copies directly or indirectly through you, then
207 | the only way you could satisfy both it and this License would be to
208 | refrain entirely from distribution of the Program.
209 | 
210 | If any portion of this section is held invalid or unenforceable under
211 | any particular circumstance, the balance of the section is intended to
212 | apply and the section as a whole is intended to apply in other
213 | circumstances.
214 | 
215 | It is not the purpose of this section to induce you to infringe any
216 | patents or other property right claims or to contest validity of any
217 | such claims; this section has the sole purpose of protecting the
218 | integrity of the free software distribution system, which is
219 | implemented by public license practices.  Many people have made
220 | generous contributions to the wide range of software distributed
221 | through that system in reliance on consistent application of that
222 | system; it is up to the author/donor to decide if he or she is willing
223 | to distribute software through any other system and a licensee cannot
224 | impose that choice.
225 | 
226 | This section is intended to make thoroughly clear what is believed to
227 | be a consequence of the rest of this License.
228 | 
229 |   8. If the distribution and/or use of the Program is restricted in
230 | certain countries either by patents or by copyrighted interfaces, the
231 | original copyright holder who places the Program under this License
232 | may add an explicit geographical distribution limitation excluding
233 | those countries, so that distribution is permitted only in or among
234 | countries not thus excluded.  In such case, this License incorporates
235 | the limitation as if written in the body of this License.
236 | 
237 |   9. The Free Software Foundation may publish revised and/or new versions
238 | of the General Public License from time to time.  Such new versions will
239 | be similar in spirit to the present version, but may differ in detail to
240 | address new problems or concerns.
241 | 
242 | Each version is given a distinguishing version number.  If the Program
243 | specifies a version number of this License which applies to it and "any
244 | later version", you have the option of following the terms and conditions
245 | either of that version or of any later version published by the Free
246 | Software Foundation.  If the Program does not specify a version number of
247 | this License, you may choose any version ever published by the Free Software
248 | Foundation.
249 | 
250 |   10. If you wish to incorporate parts of the Program into other free
251 | programs whose distribution conditions are different, write to the author
252 | to ask for permission.  For software which is copyrighted by the Free
253 | Software Foundation, write to the Free Software Foundation; we sometimes
254 | make exceptions for this.  Our decision will be guided by the two goals
255 | of preserving the free status of all derivatives of our free software and
256 | of promoting the sharing and reuse of software generally.
257 | 
258 |                             NO WARRANTY
259 | 
260 |   11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
261 | FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
262 | OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
263 | PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
264 | OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
265 | MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
266 | TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
267 | PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
268 | REPAIR OR CORRECTION.
269 | 
270 |   12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
271 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
272 | REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
273 | INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
274 | OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
275 | TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
276 | YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
277 | PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
278 | POSSIBILITY OF SUCH DAMAGES.
279 | 
280 |                      END OF TERMS AND CONDITIONS
281 | 
282 |             How to Apply These Terms to Your New Programs
283 | 
284 |   If you develop a new program, and you want it to be of the greatest
285 | possible use to the public, the best way to achieve this is to make it
286 | free software which everyone can redistribute and change under these terms.
287 | 
288 |   To do so, attach the following notices to the program.  It is safest
289 | to attach them to the start of each source file to most effectively
290 | convey the exclusion of warranty; and each file should have at least
291 | the "copyright" line and a pointer to where the full notice is found.
292 | 
293 |     <one line to give the program's name and a brief idea of what it does.>
294 |     Copyright (C) <year>  <name of author>
295 | 
296 |     This program is free software; you can redistribute it and/or modify
297 |     it under the terms of the GNU General Public License as published by
298 |     the Free Software Foundation; either version 2 of the License, or
299 |     (at your option) any later version.
300 | 
301 |     This program is distributed in the hope that it will be useful,
302 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
303 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
304 |     GNU General Public License for more details.
305 | 
306 |     You should have received a copy of the GNU General Public License along
307 |     with this program; if not, write to the Free Software Foundation, Inc.,
308 |     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
309 | 
310 | Also add information on how to contact you by electronic and paper mail.
311 | 
312 | If the program is interactive, make it output a short notice like this
313 | when it starts in an interactive mode:
314 | 
315 |     Gnomovision version 69, Copyright (C) year name of author
316 |     Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
317 |     This is free software, and you are welcome to redistribute it
318 |     under certain conditions; type `show c' for details.
319 | 
320 | The hypothetical commands `show w' and `show c' should show the appropriate
321 | parts of the General Public License.  Of course, the commands you use may
322 | be called something other than `show w' and `show c'; they could even be
323 | mouse-clicks or menu items--whatever suits your program.
324 | 
325 | You should also get your employer (if you work as a programmer) or your
326 | school, if any, to sign a "copyright disclaimer" for the program, if
327 | necessary.  Here is a sample; alter the names:
328 | 
329 |   Yoyodyne, Inc., hereby disclaims all copyright interest in the program
330 |   `Gnomovision' (which makes passes at compilers) written by James Hacker.
331 | 
332 |   <signature of Ty Coon>, 1 April 1989
333 |   Ty Coon, President of Vice
334 | 
335 | This General Public License does not permit incorporating your program into
336 | proprietary programs.  If your program is a subroutine library, you may
337 | consider it more useful to permit linking proprietary applications with the
338 | library.  If this is what you want to do, use the GNU Lesser General
339 | Public License instead of this License.
340 | 


--------------------------------------------------------------------------------