Practical GPL compliance advice
Tuesday, August 26th, 2008The Software Freedom Law Center (SFLC) describes itself succinctly:
We provide legal representation and other law-related services to protect and advance Free and Open Source Software (FOSS). Founded in 2005, the Center now represents many of the most important and well-established free software and open source projects.
Have you heard of them? If not then maybe their actions are a little more familiar. The SFLC has been involved in GPL compliance actions and lawsuits against companies such as Supermicro, Extreme Networks, Bell Microproducts, and other notable companies. Most of the time these enforcement actions are centered on the busybox application since the SFLC represents the authors of busybox and this tool is commonly shipped with embedded devices.
My position on GPL compliance is simple: I want the company I work for to comply and the customers I work with to comply with all relevant software licenses both proprietary and open source. Compliance often is a natural outcome of having a well designed engineering process. Bradley M. Kuhn in his blog says that “…I’ve found myself repeating this advice on the phone, again and again, to another new GPL violator who screwed it all up, just like the last one did.” My limited observations mesh with his. I’ve see far more simple compliance issues caused by ignorance or oversight and zero complex violations caused by forethought and malice.
Of course… I’m not in the enforcement business. I’m just not looking with the same intent that the SFLC is. My role has mostly been educational.
The SFLC just published “A Practical Guide to GPL Compliance” by Kuhn, Williamson, and Sandler to their website. I’d consider this a “must read” for a few reasons:
- They offer what I consider to be some great advice on the practicalities of compliance. Simple edicts like making sure that you don’t have one “build guru” who holds the sole knowledge of how to assemble your product.
- They clearly have an understanding of the embedded software realm from both the technical and business perspective. Direct commentary on how to work with 3rd party contractors or ODM’s is included.
- The SFLC is also a likely opponent in a GPL compliance issue if it were to face your company. They want you to comply and do so without coercion. If one were to fail to comply then the SFLC might well knock on your door. Their advice on how they view compliance is enlightening and reading up on it could be considered a risk mitigation strategy.
I do have some criticisms of the document, however. My engineering perspective of the world has often caused frustration as I’ve learned about legal issues from experts like MontaVista’s Jason Wacha. I’ve always looked for a “license compliance compiler” that would crunch your code and tell you if you were in compliance with the applicable licenses. The truth of the matter is that no such tool will ever exist. Yes, I know about Black Duck and Palamida. These tools just correlate source code to the licenses conventionally associated with the code. Not the problem I’m concerned about here.
The reason that there will never be a “license compliance compiler” is that, at least in civil law in the US, much of it seems to be about risk. My engineer observations are that attorneys view the situation and then describe the risks of proposed decisions to management. The GPL does not provide complete and total guidance on all aspects of compliance. Much of the risk evaluation comes from the viewpoints and opinions of groups who have standing to sue… in this particular case the SFLC!
[Note that this lack of complete and total guidance for complying with the GPL isn’t a criticism of the GPL. Many (all?) contracts and licenses seem to be like this.]
My criticism is that there are some places where the SFLC’s compliance guide represents their opinion of necessary compliance steps as something grander. An example:
“We consider the name of the [proprietary] compiler [that can’t be shipped with source code], its exact version number, and where it can be acquired as information that must be provided as part of the Corresponding Source.” [emphasis theirs]
The “We” in this statement is the SFLC which represents the authors of various open source licensed code. The word “must” really means that it is SFLC’s strong opinion that one should provide this information. It is also my opinion that this is a common courtesy that is painless to implement. Why not provide this information?
My opinion on the matter, and SFLC’s as well, should be more clearly designated as just that: opinion. My last nuance on this before I end is that not all opinions are created equally. SFLC can enact a GPL compliance action against your company. I can’t. You should read this document and factor the advice it offers as both practical advice for complying with the GPL and for avoiding the ire of the friends of the open source communities at the SFLC.


