12

I have a question about GPLv3 usage in a commercially sold embedded system. The product sold uses a Raspberry Pi under the cover, and in the users manual provided it does mention the use of GPLv3 software.

Considering this is an embedded system and no software/binary is physically handed over to the end user, does their code which integrates with the GPL licensed projects also need to be GPL licensed and their source made available to the users?

Note: I have mounted the microSD used in the Pi, looked at the filesystem, and found the main binary. Putting this through a decompiler, though still very obfuscated, I can see direct python import gplv3_project in the decompiled output - therefore it seems they are directly importing the library - and not using some sort of subprocess wrapper.

8
  • 8
    "no software/binary is physically handed over to the end user" I don't understand this. If you have the SD card, you have the binary - or are you saying you are not the end user? Jan 2 at 16:28
  • 9
    I'd be 99.9% sure that's irrelevant here. You are being given a copy of the software, therefore if there is GPL software in there you can request the full source. Jan 2 at 16:42
  • 2
    @trb In terms of the GPLv3 it's probably allowed if they void the warranty of the device if/when you make changes to the software. If you want a warranty that covers your own custom or experimental changes, then that type of support is naturally going to cost more to support it.
    – Brandin
    Jan 3 at 10:39
  • 4
    @trb when you change the software, the warranty surely is gone whether there is a sticker to be removed or not. The sticker shall just deter you and act as physical indicator. It's insubstantial in regard to ownership. Jan 3 at 10:41
  • 3
    Note that, unreleated to the GPL, "warntee void if removed" stickers are unenforcable or even illegal in many juristictions.
    – Vaelus
    Jan 3 at 18:33

3 Answers 3

23

Considering this is an embedded system and no software/binary is physically handed over to the end user

If you have legal ownership of the device, then the software/binary has been handed over to you, the end user. It doesn't matter that it isn't in a format that is directly readable by a PC, but packaged in a device that uses the software to perform some function.

The GPLv3 license gives you the right to obtain the source code of the GPL-licensed parts of the software on the device. You also have the right to run a modified copy of the software on the device, to the point that any keys needed to make the software operational also need to be shared.

Depending on the structure of the code, not everything running on the device needs to be under the GPL license. But if parts directly link to the GPL code, then those parts also need to be available under the GPL license.

2
7

The other answers are both correct, but I'll try to clarify further. The quoted sections are from the GPLv3 text.

In the text of the license, interpret "you" to refer to the person/company which sold you the system including the software; the license is talking about the terms of what they can/have to do with the software, including what they have to do if they distribute it.

"Considering this is an embedded system and no software/binary is physically handed over" - Acccording to your description, the software is absolutely "handed over", it's just handed over on a SD card. But GPLv3 uses more specific terms for this:

To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.

To “convey” a work means any kind of propagation that enables other parties to make or receive copies.

In this sense if you purchase a physical product with binary of a software on an SD card, it is both "propagated" and "conveyed" to you by the seller.

"does their code which integrates with the GPL licensed projects also need to be GPL licensed and their source made available to the users" - Yes, it does, because of this part of GPLv3

You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways

(followed by a description of different ways of providing the source code)

This means that the object code can only be conveyed if the source code is also conveyed using one of the described ways. Without that, they don't have permission convey the object code - including, in particular, they don't have permission to sell you a device with the object code in it.

However, the specific meaning of "integrates with" needs to be handled carefully.

To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.

A “covered work” means either the unmodified Program or a work based on the Program.

You may convey a work based on the Program ... provided that you also meet all of these conditions: c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged.

A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit.

So the key question is whether the software which integrates with the GPL software together forms a "work based on" or an "aggregate". This depends mainly on how the two interact, and whether they are "separate and independent". By its nature, including C/C++ headers in C/C++ code usually creates a "work based on" because copies of parts of the headers end up in the object code. Calling a command line program is usually an aggregate. Simply importing a python module in python code is less clear; I don't think I can reliably tell you whether that is a "work based on" or aggregate. But if it is an obfuscated binary that needs to be run through a decompiler to see the python code, that (as a whole) is almost certainly a modified work as well. If it is importing a module which is essential for function rather than optional, it is probably also a modified work.

Lastly, there is the issue that @hlieberman brought up: is the device you purchased a "User Product"?

A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.

This actually has no impact on whether the seller has to give you a copy of the source code; they would have to whether the device is a "user product" or not. But if it is a user product, they also have to give you "installation information", ie everything you need to load your own (possibly modified) copy of the software onto the device:

“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

I think that about covers the terms of the GPLv3 as they apply in your case. If you suspect a GPLv3 violation (and clearly having obfuscated code suggests that it is a knowing violation), I would encourage you to contact the authors of the software and the FSF, and let them decide how they want to handle this. There have been some prominent cases of big companies losing GPL cases against the FSF; it wouldn't be bad to add one more to the list.

1
  • 3
    I don't think both the other answers are correct, but at least one of them is :) . That said, a nice first post; +1 from me.
    – MadHatter
    Jan 4 at 9:55
-2

Respectfully, the accepted answer isn't correct. The problem you're describing is related to a problem known as the "tivoization" problem -- the distribution of binaries on systems which it's not possible to modify because of DRM. The GPLv3 was specifically written to solve this problem. However, the anti-tivoization clause only applies to products intended for regular consumer use (called "User Products" in the license); it specifically excludes products exclusively used for industrial or commercial applications. This is described in section 6.

6
  • 2
    How do you inferr from the question that the device in question is not a User Product? The phrase "commercially sold" just means that you can buy the device somewhere (and that somewhere is typically a shop). Jan 3 at 9:01
  • 10
    Respectfully, @hlieberman, you're not entirely right, either. The recipient's right to source in this case comes from GPLv3 s6b, which isn't limited to consumer products. The right to eg keys required to install an updated version come from the "anti-tivoisation" provisions at the end of s6, as you say, and if this were a primarily-enterprise product, you'd be right that those wouldn't apply. As Bart notes above, though, I don't think we can infer from the question as written that such is the case for this product.
    – MadHatter
    Jan 3 at 9:06
  • What if the inability to modify is due to something simpler, like the software is burned into a ROM?
    – Barmar
    Jan 3 at 15:34
  • 3
    @Barmar that specific example is explicitly in the license. Jan 3 at 16:02
  • 3
    The Tivo problem is "they were required to give you the source, but the source doesn't do you any good". Delivering the source was always a requirement, though.
    – hobbs
    Jan 4 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.