8

I have a D-Link DIR-816 router that runs a 'trimmed-down' version of BusyBox v1.12.1 running a linux kernel version 2.6.36 (linsongdeng@gj222d.gj.com) (gcc version 3.4.2) #35 Wed Sep 23 17:23:58 CST 2015

I say 'un-modifyable' and 'trimmed-down' because amongst other that aren't present, there is no way (that I can see) in which I can install other programs or modify anything other than configurations. This is because it does not have a package manager (dpkg, rpm etc.) or any of the make utilities.

So is that in any way a violation of GPLv2 ? If not, is it one under GPLv3 ?

  • What libc did they link busybox with? The libc is almost certainly LGPL, which provides the necessary pathway to require the ability to modify the firmware by relinking busybox with a new libc. – Joshua Sep 24 '18 at 15:27
8

One of the main differences between GPLv2 and GPLv3 is the so called "anti Tivoization clause", meant to prevent "Tivoization". From https://www.gnu.org/licenses/quick-guide-gplv3.en.html:

Tivoization: Some companies have created various different kinds of devices that run GPLed software, and then rigged the hardware so that they can change the software that's running, but you cannot. If a device can run arbitrary software, it's a general-purpose computer, and its owner should control what it does. When a device thwarts you from doing that, we call that tivoization.

And the relevant part of the GPLv3 license itself, from section 6:

"Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).

So to answer the question: No, the router software being un-modifiable is not a violation of GPLv2 (you should still have access to the source code, of course) while it could be a violation if Busybox and/or the Linux Kernel were GPLv3 licensed. In this hypothetical GPLv3 case the router manufacturer would violate the GPLv3 if they could modify the software of your router while you couldn't.

  • 6
    But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product: it would not necessarily be a violation. It would be a violation only if the provider retained the ability to modify/update the software and here the OP does not give any information implying this. – Zimm i48 Sep 19 '16 at 13:26
  • Good point, I've edited the last part of the answer slightly. – Mans Gunnarsson Sep 19 '16 at 13:44
  • 6
    Also it's not a violation to not have a package manager or other tools to install software other than what comes on the router. The scripts and other tools used to build and install the firmware image need to be provided, but D-Link isn't obliged to use a package manager to install software and if they don't they aren't obliged to provide one. The GPL requires you be able to modify, distribute and (depending on the GPL version) install modified versions of the software in the original image, but software not in the original firmware is on your plate. – Todd Knarr Sep 19 '16 at 21:54
  • 3
    @physkets: modifiable does not mean modifiable on the device itself. It could be that you have to modify the source on an external computer then load it on the device. If they retained the ability to update the software locally then (supposing GPL v3) you should have the same ability. In any case, they have to propose you the source, but again not necessarily on the device itself. – Zimm i48 Sep 20 '16 at 7:31
  • 3
    Ah, okay. So currently, I get the source, and if it were GPLv3, they would also have to provide me with a way to access/modify, provided they have not locked themselves out of the device too. I guess that would've applied, because there is a facility in the GUI to upgrade firmware using a binary downloaded from their website; so that is them having the capability to modify. – physkets Sep 20 '16 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.