Do Build Environments Give Companies an End Run Around the GPL?

Malvineous writes "I have two devices, from two different companies (who shall remain nameless, but both are very large and well-known) which run Linux-based firmware. The companies release all their source code to comply with the GPL, but neither includes a build environment or firmware utilities with the code. This means that if you want to alter the free software on the device, you can't — there is no way to build a firmware image or install it on the devices in question, effectively rendering the source code useless. I have approached the companies directly and while one of them acknowledges that it is not fully GPL-compliant, due to other license restrictions it cannot make the build environment public, and the company does not have the resources to rewrite it. I have approached the FSF but its limited resources are tied up pursuing more blatant violations (where no code at all is being released.) Meanwhile I am stuck with two devices that only work with Internet Explorer, and although I have the skills to rewrite each web interface, I have no way of getting my code running on the devices themselves. Have these companies found a convenient way to use GPL code, whilst preventing their customers from doing the same?"

Comments

Find an author

[QuantumG]

For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.

http://www.gnu.org/licenses/gpl-2.0.html

It's a straight up violation. Go find the author of the software... any author of any part of the software will do.. and invite them to sue the manufacturer. Direct them to the Software Freedom Law Center.

Re:Find an author

[fuzzyfuzzyfungus]

In the case of embedded devices, BusyBox license violations are generally the order of the day...

GPLv3

[selven]

The loophole being proposed is just a variant of Tivoization. And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.

It's still a GPL violation

[mysidia]

GNU GENERAL PUBLIC LICENSE Version 3 Free Software Foundation, Section 1, "Source Code.": The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work.

The GPL does not allow authors to hide or refrain from distributing any build scripts or information required to build/install the binaries.

They cannot have a "secret" build environment, the GPL requires that they reveal all scripts and information about the build environment.

I don't understand why the FSF would not pursue this with full vigor. Obviously you cannot exercise your freedom to modify code, if the vendor does not distribute the pieces required to build and install a binary.

No end run

[Todd Knarr]

No, the build environment doesn't provide an end-run around the GPL. Both v2 and v3 of the GPL require the distributor to provide the scripts that control the build. In GPLv2 it's in section 3, in GPLv3 it's in section 1. GPLv3 also covers this again in section 6, in a more general form when it discusses installation information.

Re:No end run

[harlows_monkeys]

The submitter didn't say that the scripts that control the build are missing. He said they don't provide a build environment. If I distribute GPL code that I build with Visual Studio, I don't have to distribute Visual Studio. I just have to distribute the project file (or whatever it is nowadays--haven't don't Windows in a long time).

It sounds like both companies are distributing embedded software for a hardware device. It's quite possible that the things they aren't distributing are part of some third-party expensive development environment, that they are using off the shelf. If that's the case, there's no GPL violation, as long as they distribute everything the submitter would need to build and install the software if he were to go obtain from that third party the development environment.

My Linksys experience

[Mathinker]

After getting the "our developers are working on it" runaround for months and months when Linksys didn't issue new drivers without the Broadcom vulnerability for my WPC54G v.4 adapter, rendering it totally useless, I decided to never, never, again buy Linksys equipment.

So you might be right that the firmware of the Linksys device I bought was upgradable, but that's useless if you have no way to make custom firmware and the vendor doesn't issue bug fixes for its original firmware.

Re:My Linksys experience

[natehoy]

Many Cisco/Linksys routers are, but I wouldn't call it "most" any more. They started building them using a closed-source OS about 3-4 years ago, and actually converted the WRT54G and WRT54GS to it mid-stream. Later, they re-released the Linux version of the WRT54G under the model name "WRT54GL".

Having said all that, Linksys has been pretty good about releasing the source code of those things they use GPL-licensed code for. Unfortunately, they tend to use the Broadcomm radios for which source code is not available, though they do publish their wrappers that control the Broadcomm binary driver.

Re:My Linksys experience

[Hal_Porter]

That's more to do with vxworks requiring less memory (and thus the hardware can be made cheaper), you can still try to flash linux onto those devices but they don't work very well due to the limited amount of memory/flash...
They still sell linux based devices, but these are no longer the lowest and cheapest routers they offer - the vxworks ones are the new bargain bucket.

It's not just less memory - vxWorks is very frugal with CPU usage too. I've seen 486 clone at 33Mhz maxing out the bandwidth on a network card while running an FTP demon out of flash memory.

The reason is that vxWorks is a very simple OS. It doesn't have much in the way of protection - all the code runs in Ring 0 on x86. So calls into the OS are just regular calls - you don't need to switch from Ring 3 to Ring 0. It can use the MMU but it doesn't usually have per process address spaces. So you don't need to flush the TLB on a process switch.

The kernel is very small and simple - it's vfs layer is only a line of two of code before jumping into a filesystem. And read() in a filesystem is very simple too - 99% of the time it just returns data from a cache buffer. TCP/IP implements zbuf to avoid copying. So the end result is that the 486 fetching a file over FTP from flash is only executing a few thousand instructions for each read - mostly copying from a buffer cache to a packet. Most the code/data probably fits in the on chip I/D cache. Which was good luck in this case, because this particular board had rather slow DRAM.

Now vxWorks isn't free in any sense - I believe it costs a buck or so per unit which is rather expensive. Still if you were switching to Linux in this system you'd need a faster CPU, more flash and more Ram. That would cost more than a vxWorks license.

Re:Obvious answer, old answer.

[RivieraKid]

He can't sue, because he has no standing. He's not the copyright owner.