I bought a Samsung laptop recently. The model is shipped with TCL (Tiny Core Linux) with BusyBox in it. Circumstantial evidence suggests that TCL is modified to meet Samsung's requirements. I found the following link in the home directory (/home/tc): https://ami.com/en/gpl-package-request-form/

Do they have rights to do this? ("this" meaning asking for my personal info and not disclosing source code via a download link)

As soon as I found this, I contacted BusyBox only to receive a perfunctory reply. I'll contact AMI after writing this, but it doesn't take much to know that they wouldn't answer to my emails.

Edit: I can confirm that the link is the only offer they provided. I checked everything that came with the laptop (manual, CD) and the product page.

  • Just learnt that the link doesn't even work because it only accepts "business email address". I think they should learn the importance of GPL compliance in a hard way. – Ashe the human Sep 13 at 6:39
  • 2
    Even if it were not modified, they must make the source code available (of the version they used). Availability by written request is OK. The GPL does not say that you have to provide a download link on a Web site. – Brandin Sep 14 at 5:40
  • 1
    My definitely not business (*.org.uk) e-mail address worked. – Philip Kendall Sep 14 at 10:48
  • 4
    Is the link to this form the only offer you received from AMI, or did they also provide a separate written offer to allow a third party to get the source code? – Brandin Sep 14 at 13:57
  • 1
    @Brandin The link is the only offer there is. I checked the CD and quickstart manual that came with the laptop. There was nothing except that link. That link doesn't even work with all the email addresses I've got. – Ashe the human Sep 17 at 11:31

Do they have rights to do this? ("this" meaning asking for my personal info and not disclosing source code via a download link)

Generally, yes: it is not inherently problematic to require contact information nor to make users submit a request to the distributor for GPL-licensed source code. This particular implementation of GPL compliance has problems, but neither of the topics you identify in your question are problematic.

This is AMI's incomplete attempt to fulfill their GPLv2 source-distribution requirements via section 3(b):

Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange

This form does not by itself satisfy that requirement (a link is not an offer). The primary components that are missing are:

  • A written promise, within the distribution itself, that AMI will provide the source code upon request. AMI is clearly willing, in general, to give out the source code, but they failed to mention it within the distribution itself.
  • A way to contact AMI to make the request (whether or not this URL satisfies that requirement isn't totally clear to me and may vary by jurisdiction)

However, to answer your specific question, requesting personal information on a website to get the GPL source code is not particularly problematic. You are naturally concerned that the submission of personal information is an unduly onerous burden in collecting the source code, but I would argue it is not. Consider this GPLv2 FAQ item:

I want to distribute binaries via physical media without accompanying sources. Can I provide source code by FTP instead of by mail order?

You're supposed to provide the source code by mail-order on a physical medium, if someone orders it. You are welcome to offer people a way to copy the corresponding source code by FTP, in addition to the mail-order option, but FTP access to the source is not sufficient to satisfy section 3 of the GPL. When a user orders the source, you have to make sure to get the source to that user. If a particular user can conveniently get the source from you by anonymous FTP, fine—that does the job. But not every user can do such a download. The rest of the users are just as entitled to get the source code from you, which means you must be prepared to send it to them by post.

If the FTP access is convenient enough, perhaps no one will choose to mail-order a copy. If so, you will never have to ship one. But you cannot assume that. [...]

For physical distribution, providing a written offer for source code based on physical mail is both necessary and sufficient to satisfy GPLv2 3(b). I point this out to show that the GPLv2 assumes a distributor who relies on 3(b) makes available a mail-order option of physical media. This necessarily requires sharing personal information: at minimum, a mailing address.

Considering that they provide a URL and no other instructions, it doesn't look like they formally satisfy the GPLv2's requirements for 3(b). This failure doesn't have to do with the solicitation of personal information specifically but comes down to the lack of formal offer and ambiguity about how to contact AMI. Their also erroneously reject some email addresses, which is a significant hurdle to contacting them.

Despite their failure to satisfy 3(b) to the letter, this looks like a pretty close effort by AMI -- they went through the process of setting up a source-distribution website, but did not include the text of an offer within their distribution. They would probably be amenable to correcting their approach after a FLOSS authority informed them they missed the mark on fulfilling their GPL requirements. Contacting BusyBox is probably the best way to do this.

Once you have a copy of the source code, you are welcome to exercise your GPL freedoms to modify and redistribute the code in any way the license allows. You can distribute your (possibly modified) copy of the source source code over a network, per sections 1, 2, and option 3(a) (if distributing a binary). You do not ever need to perform physical distribution if you do not wish to do so, as long as you do not rely on option 3(b).

  • 1
    Do, however, note that once you have your copy you can put it up on your FTP site for anonymous download, if it pleases you to do so. – MadHatter Sep 13 at 20:35
  • 1
    The AMI form does not meet the requirements of 3(b) because it does not offer EU residents a way to receive the source code, instead asking them to go to a different web site instead (AMI.de). Aside from the fact that it is a German language web site, the German site does not have any obvious place where they are offering third parties the source code. Based on this fact I would say this form definitely does not qualify as a "written offer, valid for at least three years, to give any third party ... a complete machine-readable copy of the corresponding source code." – Brandin Sep 14 at 13:59
  • You could instead contact AMI external to the form, via a public-contact e-mail address or postal address, to submit your request for the source code - This is backwards to how the GPL v2 is supposed to work. The GPL says that the distributor must make the written offer in the first place. If a recipient does not have any written offer and has to come and beg for the source code, it probably means the distributor was not complying with 3(b). – Brandin Sep 14 at 14:02
  • @Brandin I read over your comments a few times and made some edits. Thanks, and let me know if you have further thoughts. – apsillers Sep 14 at 17:11
  • "AMI, the distributor, says, ... you are entitled to receive a copy of the corresponding source from us ..." - Did AMI actually say this? Where? – Brandin Sep 17 at 11:59

The GPL does not require distributors supply the source code to you with the product, as long as they also provide a "written offer, valid for at least three years" to give you "a complete machine-readable copy of the corresponding source code."

Do they have rights to [ask] for my personal info

If they need personal information such as your name and address in order to give you the source code according to the GPL, then yes.

Do they have rights to [not disclose] source code via a download link

Nothing in the GPL version 2 or 3 obligates the written offer to be a download link. In fact, if the software is licensed with GPL version 2, they are actually required to supply the source code "on a medium customarily used for software interchange." They are allowed to charge you for the price of the medium and shipping. For GPLv3, they can either supply the source on a medium (and also charge you for the price of the medium and shipping) or they can offer you the source via download free of charge.

Since you mention BusyBox, I assume GPLv2 applies, which means a download link alone is not a sufficient offer. Although the Internet is "a medium" commonly used for software interchange, the GPLv2 literally says that you must place the software "on a medium." A URL does not place software on a medium until someone initiates a download. In other words, the "on a medium" phrase in the Version 2 license text implies that a machine-readable physical medium (e.g. a CD, a DVD, a USB stick, an SD card, etc.) is to be provided and that the fee is to cover this physical distribution. However, if AMI were to offer a free download link in addition to offering it on a physical medium (thus fulfilling their GPLv2 obligations), that would be perfectly fine, and I suspect most people would choose the free download link.

I found [a link to a Web form] in the home directory(/home/tc): ... I can confirm that the link is the only offer they provided. I checked everything that came with the laptop(manual, CD) and the product page.

According to the GPL, the distributor must "accompany" the software with the written offer. Providing a download link in a text file in a particular directory inside the product as you describe seems problematic. Why didn't they include the written offer in the written materials that normally accompany the product? If it were my machine I would be likely to simply create my own home directory and never bother looking at the /home/tc directory. The presence of this text file would not itself be a problem if it was in addition to a written offer along with the other written materials (e.g. manual, warranty information, etc.). By placing only a single text file with a URL inside a directory that some users are likely not to look at, and by not including it along with other written materials that are actually included with the product, it seems to me at that they are not trying very hard to make good on their obligation to provide a written offer.

Even if we accept that the text file and/or URL might qualify as a "written offer" (I would call it more like an "online offer" or "Internet offer") visiting the linked-to page reveals other compliance problems with the "Internet offer." The form as currently written requires that users accept an additional agreement in order to request the source:

Please complete the GPL Package Request Form. Once submitted, an AMI Representative will email you concerning your request.

GPL Text (sic)

... By clicking SUBMIT, you agree to the following LICENSE AGREEMENT regarding code that is not covered under GNU/GPL

Notice that the agreement is titled "GPL Text" but the actual text in that box is not the GPL at all. The actual GPL license requires that the written offer to the source code be made to "any third party" (GPLv2) or to "anyone who possesses the object code" (GPLv3). What if the third party does not agree to those additional non-GPL terms in the GPL Text box? If AMI want to impose additional license terms for other files (i.e. non GPL files) that are accompanied in the download package, they need to separate those files and make a GPL-only package available which can be obtained without agreeing to an additional software license. Also, they should avoid implying that their terms are part of the GPL or are related to it. They are not.

Country (For European Union residents, please visit AMI.de.) *

The AMI form asks European Union residents to visit a different Web site, written in a different language, which ultimately does not offer the source code to visitors. However, the GPLv2 requires that the written offer be made to "any third party." As the form is currently written, they seem to be excluding EU residents from their offer, which the GPL does not allow. Again, if this form were simply provided as a possible convenience (at least possibly convenient for non EU residents) in addition to an actual written offer, then there would be no problem with GPL compliance.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.