The corporate license experts I talked to said the threat of termination of a subscription would not trigger the 'no restrictions' clause of the GPLv2, which deals with a copyright, not a contract.

I... disagree in principle (for what that's worth, lol) and think a lot about "interference, coercion, or intimidation", something surrounded by some legal precedent, admittedly not in the software space, and only really dealing with discriminatory topics like real estate sales. But it seems there is some case law (ironically, dealing with SCO and IBM) on the topic.

As for whether Red Hat would enforce that agreement and cancel someone's subscription for sharing the source code, here's what Mike McGrath had to say (at approximately 50:30):

> If they [downstreams] continue to use their subscription, I think that they would find they'd have difficulties with that, but, I don't really know what else to say about it.

I think it's insane Red Hat, of all companies, is the one triggering this thought process.

Hello,

Canonical, the creator and main contributor of the LXD project has decided that after over 8 years as part of the Linux Containers community, the project would now be better served directly under Canonical’s own set of projects.

While the team behind Linux Containers regrets that decision and will be missing LXD as one of its projects, it does respect Canonical’s decision and is now in the process of moving the project over.

Attack scenario

1. Attacker creates a repository. They create a branch named "@|calc".

2. To make the attack more convincing, they set this branch as the default branch.

3. Victim clones the repository on their machine.

4. Victim tries to create an MR using glab mr create --web

5. The following command is run: cmd.exe /c "start https://gitlab.com/test-user/test-repo/-/merge_requests/new?merge_request[title]=%s^&merge_request[description]=%s^&merge_request[source_branch]=%s^&merge_request[target_branch]=@|calc^&merge_request[source_project_id]=%d^&merge_request[target_project_id]=%d".

6. The pipe character allows to break out of the URL context and launch calc.