First of all, you may want to discuss GPL compliance with your company's legal counsel and develop a clear strategy for dealing with GPL code. Complying with the GPL is not necessarily difficult, but it can place surprising obligations on you.
The intention of the GPL is effectively an end user protection effort, so that end users of the GPL-covered software always have the freedom to inspect and fix their software. To this end, it is necessary that the source code is available and that users can install modified versions. The different GPL versions express this intention in different terms.
The license of a GPL-covered software does not extend to any data processed by this software. If you have a GPL-covered tool that creates file system images, those images are not immediately covered by the GPL. However, if the images contain GPL-covered parts then those parts and only those parts are GPL covered. It is perfectly fine to have an image that contains both GPL-covered and differently-licensed parts side by side, as long as recipients of that image are free to exercise their rights under the GPL on those GPL-covered parts (such as making copies of the GPL-covered parts).
The GPL requirements only trigger when you distribute/convey/sell GPL-covered software. Purely internal use of a GPL-covered tool does not place any obligations on you.
- For example, you might have a modified version of GCC to build your proprietary software. This is perfectly allowed and you are not required to publish your modified GCC version. (GCC is covered by the GPL.)
- As a different scenario, you might have modified a GPL-covered software so that it requires your internal build tools, and you distribute binaries of the modified software. You are required to publish the corresponding source of your modified version. The corresponding source includes any scripts, tools, and other files that are necessary to build the software. This could include your internal tools.
For the GPL-covered software that you distribute as part of your embedded system (whether modified or not) you have to provide
- licensing and copyright information (also applies to other open-source software)
- source code of the GPL-covered software
- possibly: installation instructions for GPLv3-covered software
How to provide the source code depends on the GPL version. For the case of an embedded system:
- GPLv2 requires that you provide the machine-readable source code directly on a customary medium, or provide a written offer that is valid for at least three years.
- GPLv3 requires that you provide the source code directly on a physical medium, or provide a written offer valid for at least three years and valid for your customer support duration. The offer may be for a physical medium or may refer to a download server.
In case you provide an offer, the offer must be valid for whoever obtains your software, not just your immediate customers. (Consider that customers may resell or lend their devices.)
The GPLv3 contains further requirements in case your embedded system is a “User Product”, i.e. intended for personal use or intended to be incorporated into a dwelling. If a device is normally used for both personal and other uses (e.g. commercial or industrial) it is still a User Product.
For User Products, you also have to provide installation information so that users can install and run modified versions on the device. This includes any passwords or signing keys necessary for such an installation. This obligation cannot be circumvented by leasing rather than selling the devices. You don't have to provide installation information if such an installation would be impossible, e.g. for a microchip with read-only memory.
You may want to review the open source software that you include in the embedded system:
- List any open source software with their copyright information and licenses. This is easiest if you build everything from source yourself.
- Make sure that your manuals etc. contain the necessary attributions as required by those licenses.
- In case GPL or LGPL code is copied into your proprietary software or is linked with your proprietary software, inspect the licensing status more clearly: your proprietary software may be covered by the GPL. Here, I'll assume everything is a standalone executable.
- For any GPL- or LGPL-covered software, prepare to publish the source code. Ideally, your release process creates source archives of the GPL-covered software and then builds the binaries from those source archives, to ensure that the archive contains the corresponding source. Decide how you will publish the source code (e.g. CD-ROM in the device packaging, or a written offer in the manual). If you offer a download link, add an item to your release checklist to upload the source archives to your server (or better yet, automate this).
- For any GPLv3- or LGPLv3-covered software, add the necessary installation information to the manual.
