Full copyedit pass of ThinkPenguin chapter.
This commit is contained in:
parent
675f66f5f3
commit
7b025e18aa
1 changed files with 126 additions and 117 deletions
|
@ -245,14 +245,14 @@ compliance work.
|
||||||
Too often, case studies examine failure and mistakes. Indeed, most of the
|
Too often, case studies examine failure and mistakes. Indeed, most of the
|
||||||
chapters that follow herein will consider the myriad difficulties discovered
|
chapters that follow herein will consider the myriad difficulties discovered
|
||||||
in community-oriented GPL enforcement for the last two decades. However, to
|
in community-oriented GPL enforcement for the last two decades. However, to
|
||||||
begin, we offer a study in how copyleft compliance can be done correctly.
|
begin, this is a case study in how copyleft compliance can indeed be done correctly.
|
||||||
|
|
||||||
This example is, in fact, more than ten years in the making. Since almost
|
This example is, in fact, more than ten years in the making. Since almost
|
||||||
the inception of for-profit corporate adoption of Free Software, companies
|
the inception of for-profit corporate adoption of Free Software, companies
|
||||||
have requested a clear example of a model citizen to emulate. Sadly, while
|
have requested a clear example of a model citizen to emulate. Sadly, while
|
||||||
community-oriented enforcers have vetted uncounted thousands of ``Complete,
|
community-oriented enforcers have vetted uncounted thousands of ``Complete,
|
||||||
Corresponding Source'' CCS candidates from hundreds of companies, the CCS
|
Corresponding Source'' (CCS) candidates from hundreds of companies, this
|
||||||
release describes the first one CCS experts have declared a ``pristine
|
particular CCS release described herein is the first ever declared a ``pristine
|
||||||
example''.
|
example''.
|
||||||
|
|
||||||
% FIXME (above): link to a further discussion of CCS in the compliance guide
|
% FIXME (above): link to a further discussion of CCS in the compliance guide
|
||||||
|
@ -262,9 +262,9 @@ example''.
|
||||||
|
|
||||||
Of course, most CCS examined for the last decade has (eventually) complied
|
Of course, most CCS examined for the last decade has (eventually) complied
|
||||||
with the GPL, perhaps after many iterations of review by the enforcer.
|
with the GPL, perhaps after many iterations of review by the enforcer.
|
||||||
However, in the experience of the two primary community-oriented enforcers,
|
However, in the experience of the two primary community-oriented enforcers
|
||||||
Conservancy and the FSF, such CCS results routinely fix the description of
|
(Conservancy and the FSF), such CCS results routinely
|
||||||
``barely complies with GPL's requirements''. To use an academic analogy:
|
``barely comply with GPL's requirements''. To use an academic analogy:
|
||||||
while a ``C'' is certainly a passing grade, any instructor prefers to
|
while a ``C'' is certainly a passing grade, any instructor prefers to
|
||||||
disseminate to the class an exemplar sample that earned an ``A''.
|
disseminate to the class an exemplar sample that earned an ``A''.
|
||||||
|
|
||||||
|
@ -274,23 +274,24 @@ Fortunately, thanks in large part to the FSF's
|
||||||
software freedom}. Products must meet
|
software freedom}. Products must meet
|
||||||
\href{http://www.fsf.org/resources/hw/endorsement/criteria}{strict
|
\href{http://www.fsf.org/resources/hw/endorsement/criteria}{strict
|
||||||
standards for RYF certification}, and among them is a pristine example of
|
standards for RYF certification}, and among them is a pristine example of
|
||||||
CCS\@.}, electronics products have begun to appear on the market that are
|
CCS\@.}, a few electronics products on the market meet
|
||||||
held to a higher standard of copyleft compliance. As such, for the first
|
a higher standard of copyleft compliance. As such, for the first
|
||||||
time in the history of copyleft, CCS experts have pristine examples to study
|
time in the history of copyleft, CCS experts have pristine examples to study
|
||||||
and present as exemplars worthy of emulation.
|
and present as exemplars worthy of emulation.
|
||||||
|
|
||||||
This case study therefore examines the entire life-cycle of a GPL compliance
|
This case study therefore examines the entire life-cycle of a GPL compliance
|
||||||
investigation: from product purchase, to source request, to CCS review.
|
investigation: from product purchase, to source request, to CCS review, and concluding
|
||||||
|
in a final compliance determination.
|
||||||
Specifically, this chapter discusses the purchase, CCS provision, and a
|
Specifically, this chapter discusses the purchase, CCS provision, and a
|
||||||
step-by-step build and installation analysis of a specific, physical,
|
step-by-step build and installation analysis of a specific, physical,
|
||||||
embedded electronics product. The product in question is
|
embedded electronics product:
|
||||||
\href{https://www.thinkpenguin.com/gnu-linux/free-software-wireless-n-broadband-router-gnu-linux-tpe-nwifirouter}{the
|
\href{https://www.thinkpenguin.com/gnu-linux/free-software-wireless-n-broadband-router-gnu-linux-tpe-nwifirouter}{the
|
||||||
``TPE-NWIFIROUTER'' wireless router by ThinkPenguin}.\footnote{The FSF of
|
``TPE-NWIFIROUTER'' wireless router by ThinkPenguin}.\footnote{The FSF of
|
||||||
course performed a thorough CCS check as part of the certification process.
|
course performed a thorough CCS check as part of its certification process.
|
||||||
The analysis discussed herein was independently performed by Software
|
The analysis discussed herein was independently performed by Software
|
||||||
Freedom Conservancy without reviewing any findings of the FSF, and thus the
|
Freedom Conservancy without reviewing the FSF's findings. Thus, this
|
||||||
analysis provides a ``true to form'' analysis as it occurs when Conservancy
|
analysis is ``true to form'', and explains the typical procedures Conservancy
|
||||||
investigates a potential GPL violation. In this case, obviously, no
|
uses when investigating a potential GPL violation. In this case, obviously, no
|
||||||
violation was uncovered.}
|
violation was uncovered.}
|
||||||
|
|
||||||
\section{Consumer Purchase and Unboxing}
|
\section{Consumer Purchase and Unboxing}
|
||||||
|
@ -300,11 +301,11 @@ determines whether users inclined to exercise their rights under a copyleft
|
||||||
license will be successful in their attempt. Therefore, at every stage, the
|
license will be successful in their attempt. Therefore, at every stage, the
|
||||||
investigator seeks to take actions that reasonably technically knowledgeable
|
investigator seeks to take actions that reasonably technically knowledgeable
|
||||||
users would during the ordinary course of their acquisition and use of
|
users would during the ordinary course of their acquisition and use of
|
||||||
products. As such, the investigator typically purchases the device on the
|
copyleft-covered products. As such, the investigator typically purchases the device on the
|
||||||
open market to verify that distribution of the copylefted software therein
|
open market to verify that distribution of the copylefted software therein
|
||||||
complies with binary distribution requirements (such as those
|
complies with binary distribution requirements (such as those
|
||||||
\tutorialpartsplit{discussed in \textit{Detailed Analysis of the GNU GPL and
|
\tutorialpartsplit{discussed in \textit{Detailed Analysis of the GNU GPL and
|
||||||
Related Licenses}}{discussed here in \S~\ref{GPLv2s3} and
|
Related Licenses}}{discussed earlier in \S~\ref{GPLv2s3} and
|
||||||
\S~\ref{GPLv3s6}}).
|
\S~\ref{GPLv3s6}}).
|
||||||
|
|
||||||
% FIXME: Above is my only use of \tutorialpartsplit in this chapter. I just
|
% FIXME: Above is my only use of \tutorialpartsplit in this chapter. I just
|
||||||
|
@ -315,17 +316,18 @@ complies with binary distribution requirements (such as those
|
||||||
Therefore, the investigator first purchased the TPE-NWIFIROUTER through an
|
Therefore, the investigator first purchased the TPE-NWIFIROUTER through an
|
||||||
online order, and when the package arrived, examined the contents of the box.
|
online order, and when the package arrived, examined the contents of the box.
|
||||||
The investigator immediately discovered that ThinkPenguin had taken advice
|
The investigator immediately discovered that ThinkPenguin had taken advice
|
||||||
from \S~\ref{offer-for-source} in this guide, and had chosen to use
|
from \S~\ref{offer-for-source}, and exercised
|
||||||
\hyperref[GPLv2s3a]{GPLv2\S3(a)} and \hyperref[GPLv3s6]{GPLv3s6}, rather than
|
\hyperref[GPLv2s3a]{GPLv2\S3(a)} and \hyperref[GPLv3s6]{GPLv3\S6}, rather than
|
||||||
using the \hyperref[offer-for-source]{problematic offer for source
|
using the \hyperref[offer-for-source]{problematic offer for source
|
||||||
provisions}. This choice not only speeds up the investigation (since there
|
provisions}. This choice not only accelerated the investigation (since there
|
||||||
is no CCS offer to test), but also simplifies the compliance requirements for
|
was no CCS offer to ``test''), but also simplified the compliance requirements for
|
||||||
ThinkPenguin.
|
ThinkPenguin.
|
||||||
|
|
||||||
\section{Root Filesystem and Kernel Compilation}
|
\section{Root Filesystem and Kernel Compilation}
|
||||||
|
|
||||||
The CD found in the box was labeled ``libreCMC v1.2.1 source code'', and
|
The CD found in the box was labeled ``libreCMC v1.2.1 source code'', and
|
||||||
contained 407 megabytes of data. The investigator copied this ISO and
|
contained 407 megabytes of data. The investigator copied this ISO to a
|
||||||
|
desktop GNU/Linux system and
|
||||||
examined its contents. Upon doing so, the investigator immediately found a
|
examined its contents. Upon doing so, the investigator immediately found a
|
||||||
file called ``README'' at the top-level directory:
|
file called ``README'' at the top-level directory:
|
||||||
|
|
||||||
|
@ -346,9 +348,9 @@ $ cat libCMC/README
|
||||||
...
|
...
|
||||||
\end{lstlisting}
|
\end{lstlisting}
|
||||||
\label{thinkpenguin-toplevel-readme}
|
\label{thinkpenguin-toplevel-readme}
|
||||||
The investigator therefore knew immediately to begin the CCS check by
|
The investigator therefore knew immediately to begin the CCS check should
|
||||||
studying the contents of the ``README'', which contained the appropriate
|
begin with a study of the contents of ``README''. Indeed, that file contained the appropriate
|
||||||
details to get started with a build:
|
details to start the build:
|
||||||
\begin{quotation}
|
\begin{quotation}
|
||||||
|
|
||||||
In order to build firmware images for your router, the following needs to be
|
In order to build firmware images for your router, the following needs to be
|
||||||
|
@ -370,42 +372,46 @@ To build your own firmware you need to have access to a GNU/Linux system
|
||||||
(case-sensitive filesystem required).
|
(case-sensitive filesystem required).
|
||||||
\end{quotation}
|
\end{quotation}
|
||||||
|
|
||||||
In other words, the first ``script'' that investigator ran in building
|
In other words, the first ``script'' that investigator ``ran'' was the above.
|
||||||
testing this CCS candidate was the above, which ran on the investigator's own
|
This was not a software script, rather the processor for the script was the investigator's own
|
||||||
brain --- like a script of a play. Less glibly, instructions written in
|
brain --- like a script of a play. Less glibly stated: instructions written in
|
||||||
English are particularly necessary for parts of the build and installation
|
English are usually necessary for the build and installation operations
|
||||||
process that require some amount of actual intelligence to complete.
|
that demand actual intelligence.
|
||||||
In this case, the investigator was able to determine the requirements for the
|
In this case, the investigator ascertained the host system requirements
|
||||||
host system to use when constructing the firmware for the embedded device.
|
for construction of this embedded firmware.
|
||||||
|
|
||||||
GPL does not, of course, give specific guidance on the form or location of
|
GPL does not give specific guidance on the form or location of
|
||||||
such instructions. Community-oriented GPL enforcers generally use a
|
``scripts used to control compilation and installation of the executable''
|
||||||
reasonableness standard to evaluate such instructions. If an investigator of
|
and/or ``Installation Information''. Community-oriented GPL enforcers apply a
|
||||||
|
``reasonableness standard'' to evaluate such instructions. If an investigator of
|
||||||
average skill in embedded firmware construction can surmise the proper
|
average skill in embedded firmware construction can surmise the proper
|
||||||
procedures to build and install a replacement firmware, the instructions are
|
procedures to build and install a replacement firmware, the instructions are
|
||||||
likely sufficient to meet GPL's requirements. However, in this case, the
|
likely sufficient to meet GPL's requirements. Fortunately, in this case, the
|
||||||
instructions are more abundant and give more detail.
|
instructions are more abundant and give extra detail.
|
||||||
|
|
||||||
These instructions are more general than typical. Often, top-level build
|
Nevertheless, these instructions offer more options than the reader
|
||||||
instructions will specifically name a host distribution to use, such as
|
typically sees in other CCS candidates. More typically, top-level build
|
||||||
|
instructions name an exact host distribution to use, such as
|
||||||
``Debian 7 installed on an amd64 system with the following packages
|
``Debian 7 installed on an amd64 system with the following packages
|
||||||
installed''. If the build will not complete on any other system,
|
installed''. Of course, if the build will fail on any other system,
|
||||||
instructions should have such details. However, in this case, the CCS can
|
instructions \textit{should} include such details. However, this CCS builds
|
||||||
build on a wide range of distributions, and thus no specific distribution was
|
on a wide range of distributions, and thus it was appropriate (and preferred)
|
||||||
specified.
|
that the build instructions do not specify a specific distribution.
|
||||||
|
|
||||||
\label{thinkpenguin-specific-host-system}
|
\label{thinkpenguin-specific-host-system}
|
||||||
|
|
||||||
In this specific case, the developers of the libreCMC project (on which the
|
In this specific case, the developers of the libreCMC project (a Free
|
||||||
TPE-NWIFIROUTER is based) have clearly made an effort to ensure the CCS builds
|
Software project that forms the base system for the TPE-NWIFIROUTER) have
|
||||||
on a variety of host systems. The investigator was in fact dubious upon
|
clearly made an effort to ensure the CCS builds on a variety of host systems.
|
||||||
seeing these instructions, since finicky embedded build processes usually
|
The investigator was in fact dubious upon seeing these instructions, since
|
||||||
require a very specific host system. Even in this case, a
|
finicky embedded build processes usually require a very specific host system.
|
||||||
\hyperref[thinkpenguin-glibc-214-issue]{minor annoyance was found that more
|
Fortunately, it seems such doubts were generally unfounded (although the
|
||||||
detailed instructions would address}.
|
investigator did find
|
||||||
|
\hyperref[thinkpenguin-glibc-214-issue]{a minor annoyance that could be
|
||||||
|
resolved with more detailed instructions}).
|
||||||
|
|
||||||
Anyway, since these instructions did not specify a specific host system, the
|
Anyway, since these instructions did not specify a specific host system, the
|
||||||
investigator simply used his own amd64 Debian 6 desktop system. Before
|
investigator simply used his own amd64 Debian GNU/Linux 6 desktop system. Before
|
||||||
beginning, the investigator used the following command:
|
beginning, the investigator used the following command:
|
||||||
|
|
||||||
\lstset{tabsize=2}
|
\lstset{tabsize=2}
|
||||||
|
@ -430,9 +436,8 @@ The investigator did notice an additional source release, entitled
|
||||||
``librecmc-u-boot.tar.bz2''. The investigator concluded upon simple
|
``librecmc-u-boot.tar.bz2''. The investigator concluded upon simple
|
||||||
inspection that the instructions found in ``u-boot\verb0_0reflash'' were
|
inspection that the instructions found in ``u-boot\verb0_0reflash'' were
|
||||||
specific instructions for that part of the CCS\@. This was a minor
|
specific instructions for that part of the CCS\@. This was a minor
|
||||||
annoyance, and ideally the ``README'' would list that fact, but the existing
|
annoyance, and ideally the ``README'' would so-state, but the CCS filesystem
|
||||||
layout met the reasonable standard that community-oriented GPL enforcers
|
layout met the reasonableness standard; the skilled investigator determine the correct
|
||||||
typically apply, since the skilled investigator could determine the correct
|
|
||||||
course of action with a few moments of study.
|
course of action with a few moments of study.
|
||||||
|
|
||||||
The investigator then noted the additional step offered by the ``README'',
|
The investigator then noted the additional step offered by the ``README'',
|
||||||
|
@ -444,13 +449,13 @@ what was used to build the firmware image for your router. It is advised that
|
||||||
you use this configuration.
|
you use this configuration.
|
||||||
\end{quotation}
|
\end{quotation}
|
||||||
|
|
||||||
This instruction actually goes above and beyond the requirements of GPL\@.
|
This instruction actually exceeds GPL's requirements.
|
||||||
Specifically, the instruction guides users in their first step toward
|
Specifically, the instruction guides users in their first step toward
|
||||||
exercising the freedom to modify the software. While the GPL does contain
|
exercising the freedom to modify the software. While the GPL does contain
|
||||||
requirements that facilitate the freedom to modify (such as ensuring the CCS is
|
requirements that facilitate the freedom to modify (such as ensuring the CCS is
|
||||||
in the ``preferred form \ldots for making modifications to it'' form), it
|
in the ``preferred form \ldots for making modifications to it''), GPL
|
||||||
does not require that you write specific instructions explaining how
|
does not require specific instructions explaining how to undertake
|
||||||
modifications might be undertaken. This instruction therefore exemplifies
|
modifications. This specific instruction therefore exemplifies
|
||||||
the exceptional quality of this particular CCS\@.
|
the exceptional quality of this particular CCS\@.
|
||||||
|
|
||||||
%FIXME: add a \hyperref to some ``preferred for for modification'' stuff above.
|
%FIXME: add a \hyperref to some ``preferred for for modification'' stuff above.
|
||||||
|
@ -481,8 +486,8 @@ directory. Typically, this step in the CCS verification process is
|
||||||
harrowing. In most cases, the ``make'' step will fail due to a missing
|
harrowing. In most cases, the ``make'' step will fail due to a missing
|
||||||
package or because toolchain paths are not setup correctly.
|
package or because toolchain paths are not setup correctly.
|
||||||
|
|
||||||
From experience, the investigator is sure that ThinkPenguin's engineers did
|
In light of such experiences, the investigator speculated that ThinkPenguin's engineers did
|
||||||
the most important step in self-CCS verification: use one's own instructions
|
the most important step in self-CCS verification: test one's own instructions
|
||||||
on a clean system. Ideally, an employee with similar skills but
|
on a clean system. Ideally, an employee with similar skills but
|
||||||
unfamiliar with the specific product can most easily verify CCS and identify
|
unfamiliar with the specific product can most easily verify CCS and identify
|
||||||
problems before a violation occurs.
|
problems before a violation occurs.
|
||||||
|
@ -494,14 +499,15 @@ However, upon completing the ``make'', the investigator was unclear which
|
||||||
filesystem and kernel images to install on the TPE-NWIFIROUTER hardware.
|
filesystem and kernel images to install on the TPE-NWIFIROUTER hardware.
|
||||||
Ideally, the original ``README'' would indicate which image is appropriate
|
Ideally, the original ``README'' would indicate which image is appropriate
|
||||||
for the included hardware. However, this was ultimately an annoyance rather
|
for the included hardware. However, this was ultimately an annoyance rather
|
||||||
than a compliance issue due to other information available. Specifically,
|
than a compliance issue. Fortunately,
|
||||||
the web UI (see next section) on the TPE-NWIFIROUTER performs firmware image
|
the web UI (see next section) on the TPE-NWIFIROUTER performs firmware image
|
||||||
installation. Additionally, the router's version number was specified on the
|
installation. Additionally, the router's version number was specified on the
|
||||||
bottom of the device, which indicated which of the differently-versioned images
|
bottom of the device, which indicated which of the differently-versioned images
|
||||||
we should install. It would be ideal to find
|
we should install. The investigator would prefer instructions such as
|
||||||
\href{http://librecmc.org/librecmc/wiki?name=Tp+MR3020}{instructions similar
|
those found at
|
||||||
to these} in the README itself. However, application of the reasonableness
|
\url{http://librecmc.org/librecmc/wiki?name=Tp+MR3020}{instructions similar
|
||||||
standard indicates compliance, since a knowledgeable user was able to
|
to these} in the README itself; however, application of the reasonableness
|
||||||
|
standard here again indicates compliance, since a knowledgeable user can easily
|
||||||
determine the proper course of action.
|
determine the proper course of action.
|
||||||
|
|
||||||
|
|
||||||
|
@ -510,7 +516,7 @@ determine the proper course of action.
|
||||||
%FIXME: link to u-boot reflash, maybe put it in log-output dir?
|
%FIXME: link to u-boot reflash, maybe put it in log-output dir?
|
||||||
|
|
||||||
The investigator then turned his attention to the file,
|
The investigator then turned his attention to the file,
|
||||||
``u-boot\verb0_0reflash'' instructions. These instructions explained how to
|
``u-boot\verb0_0reflash''. These instructions explained how to
|
||||||
build and install the bootloader for the device.
|
build and install the bootloader for the device.
|
||||||
|
|
||||||
The investigator followed the instructions for compiling U-Boot, and found
|
The investigator followed the instructions for compiling U-Boot, and found
|
||||||
|
@ -522,7 +528,7 @@ annoyances, however, while building U-Boot:
|
||||||
\item The variable \verb0$U-BOOT_SRC0 was used as a placeholder for the name
|
\item The variable \verb0$U-BOOT_SRC0 was used as a placeholder for the name
|
||||||
of the extracted source directory. This was easy to surmise and was not a
|
of the extracted source directory. This was easy to surmise and was not a
|
||||||
compliance issue (per the reasonableness standard), but explicitly stating
|
compliance issue (per the reasonableness standard), but explicitly stating
|
||||||
that at the top of the instructions would be helpful.
|
that fact at the top of the instructions would be helpful.
|
||||||
|
|
||||||
\label{thinkpenguin-glibc-214-issue}
|
\label{thinkpenguin-glibc-214-issue}
|
||||||
\item Toolchain binaries were included and used by default by the build
|
\item Toolchain binaries were included and used by default by the build
|
||||||
|
@ -541,8 +547,8 @@ mips-librecmc-linux-uclibc-gcc.bin: /lib/libc.so.6:
|
||||||
log output from the failure} is too lengthy to include herein.)
|
log output from the failure} is too lengthy to include herein.)
|
||||||
|
|
||||||
This issue is an annoyance, not a compliance problem. It was clear from
|
This issue is an annoyance, not a compliance problem. It was clear from
|
||||||
context that these binaries were simply for a different architecture, and
|
context that these binaries were simply for a different host architecture, and
|
||||||
the investigator simply removed ``toolchain/bin'' and used a symlink to
|
the investigator simply removed ``toolchain/bin'' and created a symlink to
|
||||||
utilize the toolchain already built earlier (during the compilation
|
utilize the toolchain already built earlier (during the compilation
|
||||||
discussed in \S~\ref{thinkpenguin-main-build}):
|
discussed in \S~\ref{thinkpenguin-main-build}):
|
||||||
|
|
||||||
|
@ -583,8 +589,8 @@ Upon clicking ``Flash image\ldots'', the web interface prompted the
|
||||||
investigator to confirm the MD5 hash of the image to flash. The investigator
|
investigator to confirm the MD5 hash of the image to flash. The investigator
|
||||||
did so, and then clicked ``Proceed'' to flash the image. The process took
|
did so, and then clicked ``Proceed'' to flash the image. The process took
|
||||||
about one minute, at which point the web page refreshed to the login screen.
|
about one minute, at which point the web page refreshed to the login screen.
|
||||||
Upon logging in, the investigator was able to confirm in ``Kernel Log''
|
Upon logging in, the investigator was able to confirm in the ``Kernel Log''
|
||||||
section of the interface that the newly built copy of Linux had indeed been
|
section of the web interface that the newly built copy of Linux had indeed been
|
||||||
installed.
|
installed.
|
||||||
|
|
||||||
The investigator confirmed that a new version of ``busybox'' had also been
|
The investigator confirmed that a new version of ``busybox'' had also been
|
||||||
|
@ -611,7 +617,6 @@ u-boot to your router'', which reads:
|
||||||
\begin{enumerate}
|
\begin{enumerate}
|
||||||
|
|
||||||
\item Install and configure any TFTP server on your PC (tftp-hpa).
|
\item Install and configure any TFTP server on your PC (tftp-hpa).
|
||||||
|
|
||||||
Set a fixed IP address on your PC \ldots and connect it to the router,
|
Set a fixed IP address on your PC \ldots and connect it to the router,
|
||||||
using RJ45 network cable \ldots
|
using RJ45 network cable \ldots
|
||||||
|
|
||||||
|
@ -621,7 +626,8 @@ u-boot to your router'', which reads:
|
||||||
\item Power on the router, wait for a line like one of the following and
|
\item Power on the router, wait for a line like one of the following and
|
||||||
interrupt the process of loading a kernel:
|
interrupt the process of loading a kernel:
|
||||||
\begin{verbatim}
|
\begin{verbatim}
|
||||||
Autobooting in 1 seconds (for most TP-Link routers, you should enter tpl at this point)
|
Autobooting in 1 seconds
|
||||||
|
(for most TP-Link routers, you should enter tpl at this point)
|
||||||
Hit ESC key to stop autoboot: 1 (for 8devices Carambola 2, use ESC key)
|
Hit ESC key to stop autoboot: 1 (for 8devices Carambola 2, use ESC key)
|
||||||
Hit any key to stop autoboot: 1 (for D-Link DIR-505, use any key)
|
Hit any key to stop autoboot: 1 (for D-Link DIR-505, use any key)
|
||||||
\end{verbatim}
|
\end{verbatim}
|
||||||
|
@ -675,16 +681,16 @@ After additional trial and error over a period of hours, the investigator had
|
||||||
finally to consider this question for the first time during the process:
|
finally to consider this question for the first time during the process:
|
||||||
``Has ThinkPenguin violated the GPL?'' More specifically, the immediate
|
``Has ThinkPenguin violated the GPL?'' More specifically, the immediate
|
||||||
question was: ``Given this failure, has the distributor met
|
question was: ``Given this failure, has the distributor met
|
||||||
\hyperref{GPLv2s3-build-scripts}{the requirements for `scripts used to
|
\hyperref[GPLv2s3-build-scripts]{the requirements for `scripts used to
|
||||||
control \ldots installation of the executable' (GPLv2)} and
|
control \ldots installation of the executable' (GPLv2)} and
|
||||||
\hyperref[GPLv3-installation-information]{necessary `Installation
|
\hyperref[GPLv3-installation-information]{necessary `Installation
|
||||||
Information' (GPLv3)}?''
|
Information' (GPLv3)}?''
|
||||||
|
|
||||||
The answer to the question; however, is (at this specific stage), ``possibly,
|
The appropriate answer to the question (at this specific stage) is ``possibly,
|
||||||
but more information is needed''. Embedded installation and configuration is
|
but more information is needed''. Embedded installation and configuration is
|
||||||
a tricky and complex technical process. While the GPL requires documentation
|
a tricky and complex technical process. While the GPL requires documentation
|
||||||
and clear instructions for this process, immediately blaming the distributor
|
and clear instructions for this process, the investigator did not immediately blame the distributor
|
||||||
for honest, correctable mistakes, or issues legitimately explained by
|
for what may be an honest, correctable mistake, or an issue legitimately explained by
|
||||||
feasible alternative theories.
|
feasible alternative theories.
|
||||||
|
|
||||||
In this case, upon remembering the issues of wiring, the investigator wonder
|
In this case, upon remembering the issues of wiring, the investigator wonder
|
||||||
|
@ -708,10 +714,10 @@ option to complete the final verification of the CCS:
|
||||||
|
|
||||||
\end{itemize}
|
\end{itemize}
|
||||||
|
|
||||||
The investigator chose the latter and then contacted a libreCMC developers
|
The investigator chose the latter and then contacted a libreCMC developer
|
||||||
familiar with the product. That developer, who agreed the the RX pin was
|
familiar with the product. That developer, who agreed the the RX pin was
|
||||||
likely ruined, described an alternative method for console access using the
|
likely ruined, described an alternative method for console access using the
|
||||||
{\tt netcat}. The method described was:
|
{\tt netcat}. The libreCMC developer described the process as follows:
|
||||||
|
|
||||||
\begin{quotation}
|
\begin{quotation}
|
||||||
|
|
||||||
|
@ -735,18 +741,18 @@ uboot>
|
||||||
\end{quotation}
|
\end{quotation}
|
||||||
|
|
||||||
Upon following this procedure, the investigator was able to confirm the
|
Upon following this procedure, the investigator was able to confirm the
|
||||||
(original) version:
|
(original) shipped version of U-Boot was still installed:
|
||||||
\begin{lstlisting}[language=bash]
|
\begin{lstlisting}[language=bash]
|
||||||
$ nc -u -p 6666 192.168.1.1 6666
|
$ nc -u -p 6666 192.168.1.1 6666
|
||||||
uboot> version
|
uboot> version
|
||||||
U-Boot 1.1.4 (Jul 28 2014)
|
U-Boot 1.1.4 (Jul 28 2014)
|
||||||
\end{lstlisting}
|
\end{lstlisting}
|
||||||
|
|
||||||
Thereafter, the investigator followed the instructions as original specified
|
Thereafter, the investigator followed the instructions from
|
||||||
in ``u-boot\verb0_0reflash''. The investigator configured a TFTP server,
|
``u-boot\verb0_0reflash''. Specifically, the investigator configured a TFTP server
|
||||||
placed the newly built firmware into \texttt{/srv/tftp}. The investigator
|
and placed the newly built firmware into \texttt{/srv/tftp}. The investigator
|
||||||
then followed the remaining instructions in ``u-boot\verb0_0reflash'' as
|
also followed the remaining instructions in ``u-boot\verb0_0reflash'', but
|
||||||
written, using the \texttt{netcat} console rather than the serial console, and
|
used the \texttt{netcat} console rather than the serial console, and
|
||||||
used U-Boot's \texttt{reset} command to reboot the router.
|
used U-Boot's \texttt{reset} command to reboot the router.
|
||||||
|
|
||||||
Upon reboot, the serial console (still connect with working output) showed
|
Upon reboot, the serial console (still connect with working output) showed
|
||||||
|
@ -755,7 +761,7 @@ successful reflash of the U-Boot image built by the investigator.
|
||||||
|
|
||||||
\section{Firmware Comparison}
|
\section{Firmware Comparison}
|
||||||
|
|
||||||
To ensure the CCS did indeed correspond to the firmware original
|
Next, to ensure the CCS did indeed correspond to the firmware original
|
||||||
installed on the TPE-NWIFIROUTER, the investigator compared the built
|
installed on the TPE-NWIFIROUTER, the investigator compared the built
|
||||||
firmware image with the filesystem originally found on the device itself.
|
firmware image with the filesystem originally found on the device itself.
|
||||||
The comparison steps were as follows:
|
The comparison steps were as follows:
|
||||||
|
@ -771,33 +777,33 @@ The comparison steps were as follows:
|
||||||
morx0.squash, using the filesystem in the new squashfs-root directory for
|
morx0.squash, using the filesystem in the new squashfs-root directory for
|
||||||
comparison.
|
comparison.
|
||||||
|
|
||||||
\item Login to the router's web interface (at \url{http://192.168.10.1/ }) from a computer that is
|
\item Login to the router's web interface (at \url{http://192.168.10.1/ }) from a computer
|
||||||
connected to the router.
|
connected to the router.
|
||||||
|
|
||||||
\item Set a password using the provided link at the top (since the router's
|
\item Set a password using the provided link at the top (since the router's
|
||||||
UI warns that no password is set and asks the user to change it).
|
UI warns that no password is set and asks the user to change it).
|
||||||
|
|
||||||
\item Login to the router via SSH, using the root user with the
|
\item Logged into the router via SSH, using the root user with the
|
||||||
aforementioned password.
|
aforementioned password.
|
||||||
|
|
||||||
\item Compare representative directory listings and binaries to ensure the set of
|
\item Compared representative directory listings and binaries to ensure the set of
|
||||||
included files (on the router) is similar to those found in the firmware image
|
included files (on the router) is similar to those found in the firmware
|
||||||
we created (whose contents are now in the local squashfs-root directory). In
|
image that the investigator created (whose contents are now in the local squashfs-root directory). In
|
||||||
particular, we did the following comparisons:
|
particular, the investigator did the following comparisons:
|
||||||
|
|
||||||
\begin{enumerate}
|
\begin{enumerate}
|
||||||
\item List the /bin folder (``ls -l /bin'') and confirm the list of files is the same
|
\item Listed the /bin folder (``ls -l /bin'') and confirm the list of files is the same
|
||||||
and that the file sizes are similar.
|
and that the file sizes are similar.
|
||||||
|
|
||||||
\item Check the ``strings'' output of ``/bin/busybox'' to confirm it is similar in both
|
\item Checked the ``strings'' output of ``/bin/busybox'' to confirm it is similar in both
|
||||||
places (similar number of lines and content of lines). (One cannot directly
|
places (similar number of lines and content of lines). (One cannot directly
|
||||||
compare the binaries because the slight compilation variations will cause
|
compare the binaries because the slight compilation variations will cause
|
||||||
some bits to be different.)
|
some bits to be different.)
|
||||||
\item Do the above two steps for ``/lib/modules'', ``/usr/bin'', and other directories with
|
\item Repeated the above two steps for ``/lib/modules'', ``/usr/bin'', and other directories with
|
||||||
a significant number of binaries.
|
a significant number of binaries.
|
||||||
|
|
||||||
\item Check that the kernel is sufficiently similar. The investigator
|
\item Checked that the kernel was sufficiently similar. The investigator
|
||||||
compared the "dmesg" output both before and after flashing the new
|
compared the ``dmesg'' output both before and after flashing the new
|
||||||
firmware. As the investigator expected, the kernel version string was
|
firmware. As the investigator expected, the kernel version string was
|
||||||
similar, but had a different build date and user@host indicator. (The
|
similar, but had a different build date and user@host indicator. (The
|
||||||
kernel binary itself is not easily accessible from an SSH login, but was
|
kernel binary itself is not easily accessible from an SSH login, but was
|
||||||
|
@ -826,7 +832,7 @@ enforcement organization. However, the following annoyances were discovered:
|
||||||
device; the user must assume the web UI must be used.
|
device; the user must assume the web UI must be used.
|
||||||
|
|
||||||
\item Including pre-built toolchain binaries that don't work on all systems,
|
\item Including pre-built toolchain binaries that don't work on all systems,
|
||||||
and failure to put built toolchain binaries in the right location.
|
and failure to copy and/or symlink built toolchain binaries in the right location.
|
||||||
|
|
||||||
\item Failure to include information in the U-Boot installation instructions for
|
\item Failure to include information in the U-Boot installation instructions for
|
||||||
wiring the serial cable.
|
wiring the serial cable.
|
||||||
|
@ -854,19 +860,19 @@ can be learned here:
|
||||||
|
|
||||||
\item Even though copyleft licenses have them,
|
\item Even though copyleft licenses have them,
|
||||||
\hyperref[thinkpenguin-included-ccs]{\bf avoid the offer-for-source
|
\hyperref[thinkpenguin-included-ccs]{\bf avoid the offer-for-source
|
||||||
provisions.} Not only does including the CCS alongside binary
|
provisions}. Not only does including the CCS alongside binary
|
||||||
distribution make violation investigation and compliance confirmation
|
distribution make violation investigation and compliance confirmation
|
||||||
substantially easier, but more importantly it also
|
substantially easier, but also (and more importantly) doing so
|
||||||
\hyperref[offer-for-source]{completes the distributor's CCS compliance
|
\hyperref[offer-for-source]{completes the distributor's CCS compliance
|
||||||
obligations at the time of distribution} (provided, of course, that the
|
obligations at the time of distribution} (provided, of course, that the
|
||||||
distributor is otherwise in compliance with copyleft).
|
distributor is otherwise in compliance with the relevant copyleft license).
|
||||||
|
|
||||||
\item {\bf Include top-level build instructions in a natural language (such
|
\item {\bf Include top-level build instructions in a natural language (such
|
||||||
as English) in a \hyperref[thinkpenguin-toplevel-readme]{clear and
|
as English) in a \hyperref[thinkpenguin-toplevel-readme]{clear and
|
||||||
conspicuous place}.} Copyleft licenses require that someone reasonably
|
conspicuous place}.} Copyleft licenses require that someone reasonably
|
||||||
skilled in the art can reproduce your work. Ultimately, sometimes
|
skilled in the art can reproduce the build and installation. Typically,
|
||||||
instructions written in English are necessary, and often easier than trying
|
instructions written in English are necessary, and often easier than writing
|
||||||
to write programmed scripts to do everything. The ``script'' included can
|
programmed scripts. The ``script'' included can
|
||||||
certainly be more like the script of a play and less like a Bash script.
|
certainly be more like the script of a play and less like a Bash script.
|
||||||
|
|
||||||
\item {\bf Write build/install instructions to the appropriate level of
|
\item {\bf Write build/install instructions to the appropriate level of
|
||||||
|
@ -874,25 +880,28 @@ can be learned here:
|
||||||
in this case study \hyperref[thinkpenguin-specific-host-system]{clearly did
|
in this case study \hyperref[thinkpenguin-specific-host-system]{clearly did
|
||||||
additional work to ensure functionality on a wide variety of host build
|
additional work to ensure functionality on a wide variety of host build
|
||||||
systems}; this is quite rare. When in doubt, include the maximum level
|
systems}; this is quite rare. When in doubt, include the maximum level
|
||||||
of detail build engineers can provide with the CCS instructions.
|
of detail build engineers can provide with the CCS instructions, but also
|
||||||
|
double-check to investigate if a more generalized solution (such as other
|
||||||
|
host systems) work just as well for the build.
|
||||||
|
|
||||||
\item {\bf Seek to adhere to the spirit of copyleft, not just the letter of
|
\item {\bf Seek to adhere to the spirit of copyleft, not just the letter of
|
||||||
the license}. ThinkPenguin uses encouragement of users to improve and
|
the license}. Encouragement of users to improve and
|
||||||
make their devices better as a commercial differentiator. Copyleft advocates
|
make their devices better is one of ThinkPenguin's commercial differentiators. Copyleft advocates
|
||||||
remain baffled as to why other companies have not realized how the large the
|
that other companies have undervalued the large and lucrative
|
||||||
market for
|
market of
|
||||||
users who seek hackable devices continues to grow. By going beyond the
|
users who seek hackable devices. By going beyond the
|
||||||
mere minimal requirements of GPL, companies can immediately reap the
|
mere minimal requirements of GPL, companies can immediately reap the
|
||||||
benefits in that target market.
|
benefits in that target market.
|
||||||
|
|
||||||
\item Community-oriented enforcement organizations (for lack of a better
|
\item Community-oriented enforcement organizations do not play ``gotcha''\footnote{For lack of a better
|
||||||
phrase) do not play ``gotcha'' with distributors regarding GPL
|
phrase.} with distributors regarding GPL
|
||||||
violations. The goal in the GPL enforcement process is to achieve
|
violations. The goal in the GPL enforcement process is to achieve
|
||||||
compliance and correct mistakes and annoyances. Such organizations
|
compliance and correct mistakes and annoyances. Such organizations
|
||||||
therefore do not wish to assume a violation, and simply work with the
|
therefore take an ``innocent until proven guilty $\rightarrow$ guilty
|
||||||
vendor to correct issues. (This can be almost directly contrasted with
|
due to honest error rather than malicious action '' approach. The goal
|
||||||
|
is compliance (in direct contrast with
|
||||||
the \hyperref[Proprietary Relicensing]{discussion in \S~\ref*{Proprietary Relicensing} about the
|
the \hyperref[Proprietary Relicensing]{discussion in \S~\ref*{Proprietary Relicensing} about the
|
||||||
proprietary relicensing} business model.)
|
proprietary relicensing} business model).
|
||||||
|
|
||||||
\end{enumerate}
|
\end{enumerate}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue