First sorry for my bad english, i'm sure it's hard to read in long post.
IMO for opensource you need to pick model you like. I am writing on experience of several friends and customers, who succeed and failed on this matters.
I usually helped them with the crypto part.
Also my examples are somehow limited "use case", they wont work well for devices without "data" interface, like uCurrent.
First and main question - do you plan to make profit from it?
If NO or you don't mind if someone will make better product - fire and forget. Thats simplest case, and there is a lot of those. Open donations if you like, if you want to make support of product more self-sustaining, so it can buy you some beer. Be ready, that at any moment someone make better version.
And thats totally fine, if you want to share something cool with world.
If YES, then it's getting more interesting.
First rule in all of this:Don't release up to date recipe how to make competing, successful product, especially if your product have high complexity+value, and you don't have new version/revision prepared,
that have significantly better features and most of users will desperately want to upgrade to this new release.
Remember and keep in mind, if you plan to make opensource, your main priority to make life of users, and especially contributors easier, not life of unfair competitors.
Another thing, if someone enough big decide to invest in copying your product, without agreeing with you, you need to have all ready to hit him hard,
at moment when he start mass sales. He will have bunch of obsolete devices stock that he can't sell and he should be hurt on marketplaces he uses.
Story 1
Once manufacturer of wireless links based on ath5k chipset released build that was allowing to run some cheap D-Link Wireless AP as his product, as response to a trolls,
they required proof that he really worked hard to firmware and not just copied it from vendor.
This is how he ended his sales. People just kept flashing D-Links and most of them didn't wanted to buy his products, just because of a bit better reliability.
And it was just binary release, single firmware file, that killed everything.
Story 2, not really mine, so not sure if i understand all facts properly
You have to keep an eye also that where is most of your property kept, like ELM327 most of value was in chip firmware. They are not opensource, but
most of their hardwork was in decoding all those countless car protocols, was kept in firmware. PCB was trivial to copy, so everything that was waiting
when cloners will be able to extract firmware, and by not protecting copy they just gave them a gift, almost same way as in story 1.
And new products was not that much significantly better.
https://www.elmelectronics.com/products/ics/obd/#ELM327Low power, settings retained, buffer size, its not very convincing.
Worst part, they missed moment and market of apps built around _CLONES_, and not original hardware.
Probably
Rule 2Make your product such way, that users can quickly identify effing clone and legitimately demand their money back.
Primary trick - even it is fully opensource, nobody force you to release private keys that can confirm product genuinity.
First of all register some quick to remember domain that resemble your product name. Make some community-friendly features around it, forum, where people can talk, support system etc. Don't invest much,
but keep it ready, just in case.
Use crypto, components unique identification parts to build defense, but dont expose it early.
Several scenarios:
There is many ways how you can protect your device cryptographically. It's all depends how your manufacturing is done, i wont list it here as it will make post huge.
Then, as example - during update or first supplementary software run - show that this product is
COUNTERFEIT.
Important it must hit at right moment, most likely directly after purchase!
Perfect if you can enable this "surprise" for moment when "cloners" will run mass sales.
They will receive wonderful chargebacks, might be kicked out of marketplaces like amazon, aliexpress and others. Hurt them as much as you can.
If you discovered presence of clones too late, also you can also add routine to verify hardware/serials in new releases,
and just show already existing users (dont hurt innocent victims of counterfeit products!) that their hardware is not original
with suggestion where to send info, such as where they bought it, for sake of naming and shaming or takedown requests.
You can send them what particular flaws their hardware/software have.
You can even make some profit from it, and if copied design is OK - release custom update for it, for small fee that will make device legit and workaround some bugs introduced by "cloner".
(add crypto signature, so this update wont be copied!)
Rule 3Make sure, if someone try to reverse engineer your product, he will spot warning, that surprises are waiting for him and he gonna lose money, and better
if he make deal with you and sell legit product.
And make sure your gun loaded with multiple bullets. You might need to make warning shots too.
There is another model, that you make useable opensource product, and optional "closed" commercial features based on it. It is not truly opensource, however, it is very successful too.
It is very reasonable if you product can be used for hobbyists, where they can spend more time using free version, but paying much less or even making their own, and those who want to
use it for business, can afford to pay for "commercial" one.
But this model also has its own nuances too.
P.S. GPL. Don't idealize it. IMO it's not very enforceable, and really works only if there are large customers in your market who are concerned about licensing cleanliness. Others just dont care.