Embedded Linux Licensing LGPL / GPL / etc

Question

I would like to know what I need to do to comply with the licenses of various open source software tools and libraries that my embedded Linux system uses.

My situation is this:

I have an embedded Linux system running on an embedded device. It uses a root file system image that was provided by a third party along with the toolchain that is used for development.

I made some changes to the root file system image by adding some compiled open source programs (under various licenses), and now it also contains Qt (LGPL).

My applications dynamically link libraries to the root file system and also use Qt.

Devices are delivered to the end user with a pre-installed kernel, rootfs and application. An application that includes rootfs and possibly the kernel can be updated / updated.

---

I saw that on Android files and their corresponding license are simply listed in a long text file. Do I need to list all the individual files this way or are there other ways to solve this problem?

How is this usually done?

Answer 1

Firstly, if there is any possibility, you will incur a loss as a result of improper licensing, contact a real lawyer. The Internet is NOT a real lawyer, and you cannot sue the Internet for negligence if it gives you bad advice.

Secondly, I am not a lawyer, and most people are here. The following is my occupation, based on experience over many years. Do not blame me if you follow my advice, and it will harm you.

Third, read ALL licenses and make sure you understand what they say. If not, ask for clarification from my first point.

Fourth:

GPL / LGPL does not require an application source. They demand that the source be "on demand". Put it on a password-protected web page or save a copy that you can burn to CD and mail (you can charge for a CD and postage), if someone asks, that's enough.

You must provide the source to any binary that you distribute, even if these binary files came to you from a third party. If a third party does not provide you with its source, you must either indicate the GPL requirements or find another provider. It is not enough to send requests for GPL code to a vendor or web page for an unmodified package, especially if it came from a third-party vendor who probably changed it. You must be careful to map the correct version of the code to each binary version you create so that you can provide the source of any particular version of your product.

You must list all free (and non-free) software and their licenses. Some licenses do not require this, some (early BSDs). Better to be safe than sorry later. This is also a good way to show the user what the various licenses are and give them the opportunity to decide whether to use your product.

You want to be very careful about links if you have a proprietary application that binds the [L] GPL code. There is a chance that you might accidentally associate the code with a viral license (GPL), and then you have problems if someone notices and requires a source. Make sure you are not statically linking LGPL code for the same reason (Details: Can I embed call functions in the functions defined in the LGPL package headers? ).

You should also consider including a source for your toolchain if you use your own cross-compiler. I'm not sure that the GPL actually requires this, but it's a bit like a bastard to give someone a source, and then they failed to compile and configure it on your device. I know of at least one provider who did this - they changed the language a bit and fixed their compiler. They did not distribute the compiler and therefore did not require distributing the source. As a result, it was impossible to build from the set source so that it corresponded to the goal. AFIK they stopped doing this, so I won’t give names.

Answer 2

There are multipe options. Is your device large enough to include all sources? Are you also sending a CD? Probably no. This means that you need to include a download suggestion for all sources (and the toolchain if this is unusual enough).

You do not need to split the source file base, but you must distinguish between different packages and their corresponding licenses. In the end, you would not want to suggest that you create chimaera from Linux and Qt. You will also need to clarify which GPLv2 or GPLv3 package. Then the list should be small enough to fit the root files; I assume this is visible from the outside?

Answer 3

This is a great article on how to set up your process and system to ensure GPL compliance.

Please note that GPLv2 allows you to make a proposal for the source, but (according to the article) putting a download link on a web page is not enough. You need to provide the source on "media commonly used for software exchange."