I am extremely pleased to introduce the next speaker who is, well, all the speakers in this
room are good, I should say.
So I do want to be like, one of these speakers better than all the others, but I'm really
excited about the topic, and so I'm pleased to introduce Denver Gingrich, who is going
to speak about LGPL enforced in Germany, how we helped a purchaser use the courts to compel
compliance.
Thanks, Denver.
All right, so I'll jump in here first a little about me.
I'm Denver Gingrich, that's my website.
The main work I do is as director of compliance, it's software, freedom, conservancy.
I also work a couple hours a week on J&P, that chat, which gives you a phone number
freedom.
Now, I wanted to talk a little bit first about copyright what it is, so it is the software
right to repair and modify, to improve your devices, make them do what you want.
The heart of it is this right to fix and improve your software.
Now, this is text from the preamble of LGPL version 2.1, saying if you distribute copies,
you must give the recipients all the rights that we gave you.
So the rights that you received, the right to compile, modify, and install the software,
so you must pass those on to other people if you are distributing the software to them.
Who gets those rights?
Well, the person you gave it to, so in the case of say a wireless router, the person who
purchased that wireless router containing LGPL software.
How do they get them?
Hopefully, they just ask for the source code, and then they receive the complete source
code.
And if that doesn't happen, they should have the right to sue to get that.
Now, the LGPL version 2.1 goes into some more detail about what this means in the preamble.
It says you must provide these scripts used to control compilation and installation of the
executable.
So I think that's pretty clear, and we'll get into some even more detail on that in a little
bit.
So what are we talking about?
We're talking about this right here, the Fritzbox 4020, a very popular router made by ABM,
which I understand is the largest manufacturer of wireless routers in Germany.
And so what exactly happened with this Fritzbox router?
Well it had an offer for source code in it, and the purchaser of the device requested
the complete source code per that offer.
Now the complete source code was not received.
And months of discussion actually I believe it was over two years now.
The purchaser is actually in the front row here, Sebastian Steck.
And he, yes, big, big round of applause.
And he went back and forth, I believe, for more than two years on this before filing a
lawsuit.
And so he gave ABM a lot of time to get it right.
And they didn't, so he filed the lawsuit.
Now before I get into the details of the lawsuit, I just wanted to note that a little
bit about software freedom conservancies involvement.
So we did fund the lawsuit, and we supported it, but we were not the plaintiff, as noted
the plaintiff is Sebastian here.
Also I did want to mention that I did reach out to ABM, and I said, you know, we'd love
to have a discussion with you at Faustem about this lawsuit, and they said they were
not available to talk about it.
So I will be providing you the information that I can, sorry, ABM is not here.
I did try very hard.
So the details we have are primarily at this website.
This is linked also from the news item in the blog post that we made about the lawsuit.
So you can find things like the complaint, any court decisions along the way, and also
the exhibits, and links to the source code, which I'm going to talk about in a minute
here.
So as noted, the plaintiff was a purchaser of the device, ABM claimed to have source
code for this device, and what ABM provided was not the complete source code.
And therefore, in Germany and many other jurisdictions, the purchaser has a right to sue.
And in particular, this lawsuit was about these four projects, which are all under LGPL,
version 2.1, Sebastian chose to make the lawsuit about LGPL works.
And it causes a very interesting result, because it shows us that even the lesser GPL
does provide us all the same rights for compilation and reinstallation of modified versions
of the works onto the device as the GPL does.
So that's very fascinating.
Now, brief interlude here, I want to talk a little bit about use the source, which is
a project that we started at Software Freedom Conservancy last year.
Actually, we launched it at Faustem one year ago, so it's a great place to be talking
more about it today.
And use the source.
The goal is to show you a bunch of source code of different products and projects.
So that you can do interesting things with this.
And you can show us, you can tell us how you did those interesting things.
So there are a lot of different products whose source candidates we've put up there.
And I say candidates, because unfortunately, not all of them are complete source code.
But that is generally the goal, so that you can show what interesting things you do.
And if you're not able to do interesting things, maybe it's not in compliance with the
license.
Or you're not able to do interesting things, we also do note that as well.
So I would recommend going there if you want to, at some point, I'm going to be going
through the AVM source candidates that we've published there throughout this talk.
I'll go into some detail, but if you view them on that page, you can get a little bit
more insight as well.
So let's see what we can do with it.
What did they initially provide?
So this is round one, and they provided a tarball, and it had a bunch of tarballs inside
of it, and they had no instructions of any sort at the top level of the tarball.
So what Sebastian did was he took a look and saw, well, what should I try compiling here?
And so he thought, well, I'll start with GCC, the compiler probably good to start there,
so I can build the rest of it.
And then he tried to do some of the things that you would, you know, might think to do
like type make, since there was a make file, and run this shell script.
And none of those worked, they resulted in a bunch of errors.
And so this is what Sebastian, part of what Sebastian wrote back to AVM.
This is the English translation, that Sebastian provided, he sent them this in German.
So yeah, there's clearly some problems here with these scripts used to control compiling.
Now, that was not the only problem.
There were also problems with these scripts used to control installation.
In fact, it seemed that there may be no such scripts at all.
And so Sebastian noted that for completeness when he was talking to AVM.
And so here we are, well over two years before the lawsuit began, and this is what Sebastian
is telling to AVM.
So they go back and forth a bunch by email, and also Sebastian tells them, well, you know,
I'm going to, I'm going to try to help you out here and try to fill in some of these
missing pieces.
And so Sebastian wrote a bunch of scripts.
So that he could get to compliance faster because he wanted to be helpful and make
sure that AVM was getting everything they needed, even though he wasn't required to do that.
Like AVM is out of compliance, it's their responsibility to make these.
But he wanted to fix it quickly, so he attempted to do that for them.
And in the last candidate before the lawsuit was filed, this is round two here.
We have all of these scripts written by Sebastian and then AVM added some other things.
One example is this kernel layout environment variable, which was kind of one of the major missing
pieces from the scripts used control in compilation, that value was needed from AVM still in order
to complete the compilation because it was not obvious what device type should go in there,
because it's all using code names that are kind of internal and not obvious.
And there were also two somewhat of AVM's credits, some other scripts written by AVM.
However, these scripts did not give Sebastian the same rights to install as AVM had that is the
right to install modified versions of the software onto the router.
Now this is a problem and so because of this problem and because it had been so long
and it was clear, AVM was not going to do anything about it without a lawsuit, Sebastian filed the lawsuit.
So the lawsuit progressed, you can read the filings and things on the website as much as we have
and Ken published due to the way the German legal system works, it's not public record by default.
So if you would like, you can ask AVM for their filings, we were not able to publish those ourselves.
But that, you know, Ken shows some more information if you're interested.
Now so we went back and forth with these filings that is to say Sebastian and AVM went back and forth
with filings and eventually AVM did provide the scripts used to control installation.
So this was very exciting and so that effectively ended the case.
The lawsuit was about this LGPL compliance which Sebastian got and Sebastian very nicely shared the
scripts with us as well. So these scripts used to control compilation and installation.
He gave them to us at software feed and conservancy and so we were able to post them
on use the source so that everyone can have the complete source code for the LGPL works on this AVM router.
Now AVM has still not posted these scripts on their website. I'm not sure why that would make
things a lot easier for people. I checked this morning. I still couldn't find them.
And so we would encourage AVM to publish those on their website and and yeah, we think that would be
a better way as opposed to having to have people ask them for the source code again and then
maybe going back and forth. I hope they would provide you these if you asked for them for their
offer but I don't know how they respond to that. So you may be interested in what these scripts
used to control installation actually look like what is compliant with the license. Well,
I'll go into some details here quote a few parts of these scripts and also just to
just to kind of clarify here what we're talking about. So scripts scripts can be viewed broadly.
So we didn't say to AVM you need to provide us with shell scripts that do all of these things
to install it onto the device. We you know we've said it's okay if you provide
things in a human language and in particular they provided the these scripts in German
and they're primarily a set of German instructions with a few notes to use certain shell
scripts or other programs along the way. And so what I'm going to quote here is the
English translation that Sebastian provided to us of these German scripts from AVM. Both of them
are included in the in the source package on on use the source. So the first thing you need to do
is you get these original firmware images from AVM download them from their website or otherwise
and then you unpack them. And it provides specific commands to use to do that. Then you replace
the desired files with specially generated files. So here they're talking about the files that
you may have modified these LGPL works. So you can replace the ones in the firmware image with the ones
you have modified and then you pack those back into an image file and they provide the the commands
that you would use to do that. Then you run this command right here and this installs that firmware
including your modified LGPL works onto the device. And finally you supply the Fritzbox 4020 with power
and achieve great success because you are now running the modified versions of the LGPL works on the
router. So this is wonderful. We are very happy to have these scripts and have been able to share them
with you as well. Now what exactly is it we won? Well we got all the rights that the software
developers gave to AVM that is the right to compile, modify and install the software and we're
very happy about that. We got the source code and also interestingly AVM also chose to pay
Sebastian's legal costs in this case. So essentially the case was settled but Sebastian got everything
he asked for in the lawsuit. So anyway I think that's an interesting result. The GPLs by which I
mean the AGPL and GPL give rights to recipients. That's you know what we do and then Sebastian has shown
us that if you weren't weren't given those rights you can get them by suing if you need to.
So you may be interested in some other work that software freedom conservancy does to promote coffee
left and make sure people can make practical use of the of the freedoms that they have.
That is to be able to reinstall changes onto the devices that they have. So we show people how it's
done. We make our own hardware. We made the OpenWRT1 this past year in collaboration with
OpenWRT which is our member project and we of course provided the complete source code
from day one for that. Not just because it was required since it is but because obviously we want
to have people's ability to do as they want with their devices to be front and center.
If you have an OpenWRT1 you can get the source code by using the offer on the box. It's also
on use the source and just in case we also etched the offer for source code into the PCB.
So if you have an OpenWRT1 you can open it up. Take a look at the bottom of the PCB and you'll
have your offer for source code right there as well. So we don't like to sue. We would like
things to get resolved without lawsuits but in case a company is not in compliance and it has been
some time as was the case in Sebastian's suit. We sometimes do need to sue people. So
sue companies that is. So in this case, physio here we bought a physio TV. We wanted to make
an OpenWRT like system for the physio TVs. So we bought the TV and requested source code.
We did not receive the complete source code. In fact, we still haven't to this day. And so
we are in the middle of this lawsuit with physio. It goes to trial in September and we are of course
hopeful for a positive result there. So we also discussed the code that we get as I mentioned
on use the source and so I would encourage you to check out use the source and see what we have
on the website and I really encourage you to upload any source candidates you receive so that
people can see them and we can discuss those all together. So I just wanted to highlight that
use the source again. Check it out. Also, you know, if you like our work, I'd encourage you to
become a software freedom conservancy sustainer. And as you might expect for a talk of this nature,
the complete source code for these slides are also available. So you can go to that slides link
go to the last page and then tap on the slide source available. So thank you very much. I'll take some
questions. And thank you. This is a fast jinn.
Yeah, so I'm curious why were they required to publish the source code for LGPL a software since
this is generally used for libraries and they tend to be dynamically loaded and basically this required
requirement would not be applied unlike GPL or AGPL. So what was the software provider relationship
with the upstream LGPL project in order for this constraint to be applied? So the LGPL requires that
you provide the complete source code for all the LGPL works. If you are distributing those
LGPL works to someone else. So I mean, if you have something that depends on an LGPL library
and you only distribute that thing and not the LGPL library itself, then you know, they're perhaps
there are other ways to comply. But in this case, ABM was distributing both the thing that was linked
to this LGPL library and the LGPL library itself. So if that's what you're doing, then you need
to provide the complete source code for the LGPL library. Hi, thank you for your talk. I'm wondering
what's the general feedback from like how do judges, attorneys and such
handles a subject because I guess most of them are not familiar at all with those technologies
and those licenses. And so they feel like, I mean, how does that happen? Sure, so in a general sense
and just to you know, back up here a little bit, I'm not a lawyer. I don't provide legal advice
all of that stuff. And so, so to answer your question, I mean, just what what I've seen generally
is, you know, lawyers do what they can with the facts that are available in the case of ABM looking
through the the filings. It appears that an expert would have been called if necessary later on in the
case. It sounds like due to how things worked out. That was not necessary in lawsuits in the United
States often experts are introduced earlier in the case. And so, so that's usually what happens
there speaking not as a lawyer, just as someone who's looked at some legal filings.
Thanks for the interesting talk. Nowadays, many devices, even in the embedded world use
techniques like secure boot for instance to make it impossible to run something that is not
signed by the vendor, and especially for the low cost devices, usually that's a one way
street, so you cannot like revert the secure boot mode once it is applied. How does it work out in
this case? Can the vendor then provide a special unlock device for you or does it need to run
on the same device or how does it work? So, there is a famous story of a printer
where, yeah, okay, so most people know anyway, it seems like the the person who wanted to change
the software on their printer did not want to buy a brand new printer to install that software
onto, they wanted to do it on the device that they had with them already. And so, you know,
there may be different ways that companies try to impede your ability to reinstall the LGPL
and the GPL say you need to have the scripts used to control compilation and installation,
so, you know, whether you do that by like wiping out some chip that requires a key or something
like that, I mean, it's not specific in what it says you must do as long as that is achieved.
Hi, there were thanks for the talk. AVM was sued, not because they're the manufacturer,
but because there were the seller, right? AVM was the manufacturer is my understanding here.
Right, but, yeah, do you sue the manufacturer or the guy who provided you the router?
The guy who sold you, right? Yeah, I think it will be faster to sue the manufacturer
because the distributor probably just pointed them, but that's just me as not a lawyer, etc.
Hi, in your dealings with this and other companies, how much of this is bad faith or
Mary's on their side, we're sucing competence or they just never thought about it before?
Yeah, very good question. I, of course, wish that it were, you know, incompetence, sadly,
because that would be perhaps easier to fix, but we found that a lot of times companies are
appear to be, appear to be establishing a line they made up and they are just sticking to that line,
and so that's why we unfortunately need lawsuits. I, you know, I don't know if that's the case
and any particular one it just feels like it in some cases for me. We have one last question here.
To what are, I understand where you're, where you're getting the, you need to provide
the scripts that control the compilation installation, no problem. You seem to be inferring an
additional requirement that those scripts succeed in an environment outside the, outside of the
manufacturer. Let's say that I'm a manufacturer, I've got my scripts, they require my internal
key signing, they require my internal infrastructure, they call out to these things. I give you
my exact scripts, calls out to internal server one, internal server two, gets a bunch of keys,
signs a bunch of stuff, does all this stuff. It absolutely was the exact script I used,
I provided to you, you try and run it fails, as expected because you're not in my environment.
What are you, depending, relying on for the idea that the script has to actually succeed in any other
environment? So as I mentioned, the scripts can include, if, for example, your scripts do not
successfully complete by themselves, then you can add add instructions in, you know, German or English
or whatever, to describe how it completes. The issue here is that it sounds like in your
situation that you're describing, you as the manufacturer are able to compile modified versions
and install them on the device. And so that is what we're talking about here is passing on those
rights, as mentioned in the preamble, you have to give those rights to compile and install
onto the user. So that, that is what you have to do, and that is what we will sue to make happen.
I think my time is up, so thank you very much.