Confusion after lawsuit against AVM over Fritzbox firmware
Following the conclusion of a lawsuit by a software developer for further source approval against AVM, there is initially no more clarity than before.
(Image: AVM)
With the support of the Software Freedom Conservancy (SFC), developer Sebastian Steck has filed a lawsuit against router manufacturer AVM for the release of further source code in accordance with the LGPL. The proceedings ended without a verdict. Steck withdrew his lawsuit and AVM paid the legal costs. All sides see themselves as winners.
The reason for the lawsuit was that Steck was unable to modify, compile and install libraries on the Fritzbox 4020 firmware using the source code provided on request on AVM servers. In particular, Steck wanted to adapt the uClibc library licensed under LGPL. According to the developer, there were several problems with this. As AVM did not respond adequately to the request for the supposedly missing source code components and information required for compilation in Steck's opinion, the developer filed a lawsuit and brought the SFC on board for support.
Lawsuit settled after AVM's concession
A few months after the lawsuit was filed, AVM provided Steck with the information he needed for his purposes. For example, the undocumented environment variable KERNEL_LAYOUT must contain the value drgfly so that the kernel sources can be compiled. AVM has also created instructions for replacing files in an existing firmware image and transferring the modified image to the Fritzbox. AVM also uses tools from the Freetz project for this purpose.
Videos by heise
Another part of the complaint was therefore whether it is sufficient to run the modified software only in the RAM of the device or whether a permanent modification must be possible for users. The instructions issued by AVM in the course of the lawsuit allow the latter. This means that this question has not been legally clarified.
Voices of the parties to the lawsuit
Steck explained to heise online that the information had enabled him to translate the LGPL libraries and install the resulting .so binaries on the Fritzbox. He and the SFC then declared the lawsuit settled and AVM agreed to pay the legal costs. What was not part of the lawsuit and remains unclear is the handling of GPL sources. How these sources, including the Linux kernel, can be compiled was therefore not clarified.
AVM did not publish the complete sources on its website, explained Denver Gingerich from the SFC to heise online. The control scripts for compilation and installation were missing. These were only released for the Fritzbox model 4020 in the course of the process and can be downloaded from the SFC website – as part of the complete firmware sources. Steck has also published the compile_06.83.sh script, which can be used to translate the sources.
Upon request, AVM emphasized that the company “has actively supported the open-source community for years, as it ensures long-term innovation and that in the course of these proceedings it turned out that the source code was sufficient, which is why the other side has withdrawn all allegations of potential LGPL/GPL infringement.” When asked about the contradictory representation of SFC in particular, the company went on to explain that this was a lawsuit brought by a private individual, “SFC never appeared before AVM in the legal proceedings”. Regarding the assumption of the legal costs, AVM also explained: “As the lawsuit was brought by a private individual who has withdrawn the lawsuit and AVM is interested in the amicable outcome of legal proceedings, we have voluntarily decided to pay the legal costs.”
The SFC's statement is therefore incorrect and AVM has already requested corrections, the company added. AVM points out, for example, that other developers of free software, such as the popular Freetz and OpenWRT projects, had no problems with the Fritzbox sources, not even in 2021. The error messages that the plaintiff received were much more indicative of inexperience with cross-compiling processes. For example, no cross-compiler was found in the paths of his development system. The environment variable that defines the target architecture was not set, even if it could have been easily derived from the available source code.
Legally, therefore, nothing was clarified in this process regarding the sources and compliance with the requirements of the LGPL and GPL licenses. However, as a result, there are more easily accessible and implementable instructions.
OpenWrt emphasizes the following representation: "OpenWrt has consistently found problems with AVM's source code candidates, including missing source code for Linux kernel drivers. OpenWrt urges AVM to provide the complete source code for all copylefted programs, such as any code that Linux's license (the GPL) requires AVM to release, to anyone who requests them. We also understand AVM has had recent requests for such source code (including from our non-profit home, SFC) and has not provided complete source code in response, which we believe to be a violation of the copyleft agreements."
AVM responds to this: "AVM always provides the complete source code for all copyleft programs. If something has been overlooked and the GPL delivery is not complete, members of the OpenWRT community are welcome to contact us as before."
(dmk)
