I added this as a comment in a related thread on XDA, but it seems relevant here:
Brief background - my name is Matthew Garrett. I'm a Linux kernel developer working for Red Hat. I bought an original Nook back in 2009 and was responsible for getting Barnes and Noble to release the full kernel source code. When the Nook Color was released I did the same. I've been active in enforcement of the GPL and have a keen interest in helping (or making) companies comply with their obigaitons.
Having said that.
One of the significant differences between GPLv2 and GPLv3 is that GPLv3 makes explicit the requirement that signing keys be shipped. It has been argued that the GPLv2 implicitly requires the same, in the form of the requirement for the scripts required for installation. I'm sympathetic to that claim, and I will not personally distribute any code that requires a private signing key. But I'm not a lawyer and I'm certainly not a judge. Many people who are active in GPL enforcement will agree that vendors should provide the signing keys - but I don't think you'll find any who will actually make that the basis of a case.
B&N are not the only company to require signed kernel images. Many Android devices have locked bootloaders. I think this is a despicable anti-consumer design choice, but nobody's taking action against it. B&N have provided you with the kernel source code. They've done better than many by also providing you with the configuration file. They have a strong argument that by doing so they've complied with the requirements of GPLv2, and while you (and I) may disagree, that's almost certainly going to be as much as they'll be required to do. Consensus at the moment is that they don't need to do any more.
If it went to court then you may end up finding a judge who would rule that they're in violation, but I wouldn't put money on it. I think it's far too extreme to claim that they're actively violating.
As a bit of further clarification, I've downloaded the source tarball and checked it out. The kernel source appears as complete as I'd expect it to be. I don't have a Nook Tablet to check the filesystem, but the userspace code at least roughly matches what ought to be there. The bootloader source seems to match the hardware. As far as I can tell the only argument is that the NT will only boot with a signed bootloader and kernel, and the signing keys aren't included. There's no broad consensus that GPLv2 requires those keys.
Actually, it seems that there's one missing file that prevents u-boot from building:
include $(TOPDIR)/../../../device/ti/blaze/BoardConfig.mk
Given the relative path, I'm betting that this is an error rather than malicious - they simply didn't tar it up with the other files. It should be fixed, but the fact that it isn't is not a showstopper.
"Many Android devices have locked bootloaders. I think this is a despicable anti-consumer design choice, but nobody's taking action against it."
This struck a cord with me.
I own an iPhone, and an Acer Iconia tablet, both of which are locked down. I've jail-broken, or rooted the devices, but the fact that I can't legitimately install custom roms, etc, frustrates the hell out of me.
One advantage I see (but don't agree with) for the iPhone being locked down is users locked into the app store, but for the Iconia?
B&N was right to delete his worthless request/complaint. It contained no information that would actually help them resolve the problem. All it said in his post on their forums was that:
1. He could not get the source they released to compile.
2. Quoted a GPL violations FAQ.
3. Told them they are doing a bad thing.
4. Told them to fix the problem.
How about actually giving them DETAILS about what failed to compile. From his complaint they have no idea if the problem is because they made a mistake in the source release, or if there is something wrong with his environment, or whatever.
He's an experienced Android kernel hacker, so he's no amateur. He's saying it won't compile using what they've given. He's also stated it fails under the common Android build setups he's used for other Android kernels. One of the requirements of the GPL is to provide the build/make instructions to allow other developers to build it themselves. It would appear B&N isn't quite doing this.
"The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable."
No, he's saying it won't boot. Big, huge, enormous difference. He can clearly get it to compile, since he apparently produced some image that he thought (apparently wrongly) that the Nook would be willing to boot.
I agree, with you this post titled "B&N has a Legal Obligation to release full source code" is very adversarial. It sounds like he might want to sue B&N and them might believe he is committing libel. There is no reason why they would want host his comment. He would be much better off, if he was friendly asking (not demanding) help from B&N or other users who might of gotten it to compile, and thanking B&N for making the Nook and providing the source code.
>He would be much better off, if he was friendly asking (not demanding) help from B&N
Agreed, but as far as the GPL goes, he's well within his rights to demand they follow their obligations. The fact that it was overlooked to begin with looks somewhat shifty..
No, even if he was completely wrong (which he probably isn't), deleting the post would not be appropriate. If they needed more information, they could ask. If he was wrong, they could correct him. What kind of asshole does it take to think just ignoring and deleting legitimate requests is appropriate?
Contrary to the title, it looks like Barnes & Nobles did release some sort of source code. The fact that the author wasn't able to compile them into something doesn't mean BN is violating the GPL. I'd cool down before making such accusations.
Based on some of the screenshots, it might just be the case that the author doesn't know how to upload the kernel to the Nook correctly.
Moreover -- correct me if I'm wrong -- GPLv2 doesn't require that the device manufacturer support software upgrades anyway. It's only v3 that introduced the "anti-TiVoization" clause, and the kernel isn't GPLv3.
AdamOutler is not one that would have trouble uploading source code to the device. He's saying that it's not compilable. There are other threads and statements saying there are missing components from the source release.
I suspect that the author of this piece is taking a very optimistic interpretation of the GPL and Barnes and Noble a very conservative interpretation.
They only GPL'd code on the Nook as far as I can tell is the Android kernel. So if they distribute the patches they made to the kernel to support their tablet then they are done. They have no obligation whatsoever to distribute source to their book display application, their UI, or their other 'user land' applications.
Its the same with Google, the 'Google Experience' applications (mail, maps, Etc) are neither GPL'd nor 'free' for manufacturers to put on their boxes.
He's not asking for that. He's an experienced Android kernel hacker. He knows the difference between kernel and userland. He's informing B&N that their kernel source is incomplete. B&N is required by the GPL to release the full source of the kernel, build instructions and everything they compile directly into it (read: not 'apps') in order for another developer to be able to compile the full kernel. All of that is required by the GPL. If you don't follow it, you're not permitted to redistribute works under the license.
He's asking for them to release the Kernel source in compilable/working form which it doesn't currently appear to be in. He's not asking for the userland apps, or even binary kernel modules to be released.
Not to be a jerk here, but has the bug submitter ever worked for a large company before? From the screenshots and the timestamp of the xda post, it looks like this issue he's submitted is roughly only two days old.
Forum posts such as these have to get triaged by their forum managers, TT's cut to the appropriate groups responsible for the issue mentioned, accepted by the proper group, placed in a priority queue based on severity of end-user impact, and assessed along with all of the other work they are doing. At least this is how it is at the large company I work for.
Sure he has a lot of 'laurels' for his post, but a two day old post of one person not being able to compile their Nook sourcecode is probably not high on the list of things which must be addressed immediately. Chill out and give it some time to be addressed.
I'm not saying at all that they should get a pass. I'm saying this is a complaint via a single user from their forums which will be triaged and addressed, just not this immediate second.
First of all, make sure B&N is violating the GPL. GPLv2 does not require them to make it possible to flash a new OS into the device and boot off it. As long as you can compile the sources into an executable that can possibly run, they are compliant.
I too would like Linux to be licensed under GPLv3, but a lot of companies wouldn't. I seriously doubt my TV manufacturer would be OK with me running my own code on it. Or my cable box.
Samsung use (used?) Linux as the base OS for a large number of their TVs so of course replacement firmware projects sprang up (e.g. SamyGo [1]). The project added additional functionality to their TVs like playing movies from a USB stick - features that Samsung had restricted to their higher-end TVs.
Within a few months Samsung had released an ‘official’ firmware upgrade that removed the ability to load unofficial (unsigned I guess?) updates.
Technically, anyone who has contributed to the Linux kernel can drag them to court. Probably not something an average developer will jump into :) That said, Harald Welte has a dedicated site for this : http://gpl-violations.org/ and he is pretty active chasing violators. Personally, I believe if there is straightforward evidence that the sources they are providing is incomplete, spreading the word around is a good start!
As far as I could tell from that thread, there isn't, just a lot of ignorance. B&N has no legal obligation to tell them how to get a custom kernel to boot on the Nook.
I applaud his efforts, but he's aggressively misspelling Barnes and Noble's name in that post, and that lack of attention to detail makes him much harder to take seriously.
Brief background - my name is Matthew Garrett. I'm a Linux kernel developer working for Red Hat. I bought an original Nook back in 2009 and was responsible for getting Barnes and Noble to release the full kernel source code. When the Nook Color was released I did the same. I've been active in enforcement of the GPL and have a keen interest in helping (or making) companies comply with their obigaitons.
Having said that.
One of the significant differences between GPLv2 and GPLv3 is that GPLv3 makes explicit the requirement that signing keys be shipped. It has been argued that the GPLv2 implicitly requires the same, in the form of the requirement for the scripts required for installation. I'm sympathetic to that claim, and I will not personally distribute any code that requires a private signing key. But I'm not a lawyer and I'm certainly not a judge. Many people who are active in GPL enforcement will agree that vendors should provide the signing keys - but I don't think you'll find any who will actually make that the basis of a case.
B&N are not the only company to require signed kernel images. Many Android devices have locked bootloaders. I think this is a despicable anti-consumer design choice, but nobody's taking action against it. B&N have provided you with the kernel source code. They've done better than many by also providing you with the configuration file. They have a strong argument that by doing so they've complied with the requirements of GPLv2, and while you (and I) may disagree, that's almost certainly going to be as much as they'll be required to do. Consensus at the moment is that they don't need to do any more.
If it went to court then you may end up finding a judge who would rule that they're in violation, but I wouldn't put money on it. I think it's far too extreme to claim that they're actively violating.