I'm not so convinced that this represents a meaningful decision on the LGPL or anti-tivoization clauses in general.
First of all, the outcome was a settlement affirming that the parties no longer had any disagreements, not a judgement. But more importantly, if you look into the details I think you will see this was more of a case where the complainant didn't have adequate expertise to understand how to accomplish his goals. You can see the final delivery of "installation instructions" that was accepted at the SF Conservancy's website: https://sfconservancy.org/usethesource/candidate/avm-fritzbox-4020-683-round-3-of-n/
Note that it did not include any new source code or installation scripts. I'll quote (and translate) the first two sentences:
"Die nachfolgende Schritt-für-Schritt Anleitung fasst im Wesentlichen den Inhalt der öffentlichen Quellen (s1) sowie (s2) zusammen. Bitte achten Sie darauf, die Schritte vollständig und in der richtigen Reihenfolge durchzuführen."
"The following step-by-step instructions basically summarize the content of the public sources (s1) and (s2). Please make sure you actually follow them, completely and in the correct order."
I do think there are some interesting questions left unresolved here, since it was settled instead of taken to judgement: if a competent embedded developer could figure out how to unpack, repack, and install a new firmware image on the router, is that sufficient? If not, how detailed must the instructions be? If my 88 year old grandmother can't figure out how to recompile and install her own LGPL library on her router, does that mean I'm out of compliance? What about if it's some guy with a computer science degree who mostly writes javascript but has never done embedded development before? (And all of the shades in between those two?)
Basically, where is the line between providing source code and build scripts, and providing technical support or teaching people how to build software?
The main question for my newsletter is: Does the anti-tivoisation clause hold for LGPL-2.1? Or reworded: Does a manufacturer have to provide installation instructions so that a user can install a modified version of a library on the device?
I got that wrong in my newsletter: "AVM provided the source code but not the compilation and installation scripts (see AVM FRITZ!BOX 4020 6.83 ROUND 3 OF N for more details and the source code)." - I will correct that.
You are asking a different questions: What skills can be expected from a user who tries to install a modified library on the device?
I agree with you that the installation instructions provided by AVM - after (!) they got sued - are enough. Anyone with basic skills in embedded Linux development should be able to follow these instructions. Manufacturers can expect a certain skill level from their users if they want to exercise their rights from (L)GPL. For example, users must provide an interface-compatible library.
I give my licensing customers the following rule of thumb. The build and installation instructions must not be more difficult than for the manufacturer's developers, but they don't have to be simpler either. The simplest solution is to provide the build and installation scripts and documents that the developers use - of course, with proprietary software stripped out. Manufacturers can't go wrong with this approach.
Therefore: No, your grandma need not be able to install a modified library on her Fritz!Box and the Javascript developer neither.
Well, I think the point that AVM was making when they take pains to say that the installation instructions were already publicly available is that the existing publicly available instructions _should have been_ enough. That is to say, "the developers of the Freetz project were able to do it without us holding their hands; perhaps you should have been able to also".
But more fundamentally, I think it's always important to take the results from non-binding settlements of lawsuits with several grains of salt. The suit was funded by the Software Freedom Conservancy; their interests are generally to get meaningful wins, either in the form of forcing companies to release previously closed software, getting companies to comply with FOSS licenses that they are out of compliance with, or to establish legal precedent supporting their maximalist interpretation of FOSS licenses. In this case, they got none of those things! They chose to settle when the only new thing they got out of AVM was a short how-to document explaining how to do something that was already documented publicly, and they withdrew all allegations of a GPL/LGPL violation. If they thought they had any kind of a case here, they would have pushed for more. So to me, this case rather looks like a loss for the SFC that they are trying very hard to spin as a win.
As for the legal costs, I suspect that AVM simply concluded that it was cheaper to pay the SFC's costs than to drag out the case arguing over who should pay. I could also speculate that the SFC may have agreed to settle only on the condition that AVM paid costs.
I'm not so convinced that this represents a meaningful decision on the LGPL or anti-tivoization clauses in general.
First of all, the outcome was a settlement affirming that the parties no longer had any disagreements, not a judgement. But more importantly, if you look into the details I think you will see this was more of a case where the complainant didn't have adequate expertise to understand how to accomplish his goals. You can see the final delivery of "installation instructions" that was accepted at the SF Conservancy's website: https://sfconservancy.org/usethesource/candidate/avm-fritzbox-4020-683-round-3-of-n/
Note that it did not include any new source code or installation scripts. I'll quote (and translate) the first two sentences:
"Die nachfolgende Schritt-für-Schritt Anleitung fasst im Wesentlichen den Inhalt der öffentlichen Quellen (s1) sowie (s2) zusammen. Bitte achten Sie darauf, die Schritte vollständig und in der richtigen Reihenfolge durchzuführen."
"The following step-by-step instructions basically summarize the content of the public sources (s1) and (s2). Please make sure you actually follow them, completely and in the correct order."
I do think there are some interesting questions left unresolved here, since it was settled instead of taken to judgement: if a competent embedded developer could figure out how to unpack, repack, and install a new firmware image on the router, is that sufficient? If not, how detailed must the instructions be? If my 88 year old grandmother can't figure out how to recompile and install her own LGPL library on her router, does that mean I'm out of compliance? What about if it's some guy with a computer science degree who mostly writes javascript but has never done embedded development before? (And all of the shades in between those two?)
Basically, where is the line between providing source code and build scripts, and providing technical support or teaching people how to build software?
Hi Jon,
Thank you for your helpful feedback.
The main question for my newsletter is: Does the anti-tivoisation clause hold for LGPL-2.1? Or reworded: Does a manufacturer have to provide installation instructions so that a user can install a modified version of a library on the device?
My answer still is: Most likely yes. This is corroborated by this fact: Only after AVM was sued, AVM provided the installation instructions. The downloadable sources before the law suit (https://sfconservancy.org/usethesource/candidate/avm-fritzbox-4020-683-round-2-of-n/) do not contain the installation instructions, whereas the downloadable sources after the law suit contain the them (look for install_de.pdf or install_en.html in https://sfconservancy.org/usethesource/candidate/avm-fritzbox-4020-683-round-3-of-n/).
I got that wrong in my newsletter: "AVM provided the source code but not the compilation and installation scripts (see AVM FRITZ!BOX 4020 6.83 ROUND 3 OF N for more details and the source code)." - I will correct that.
You are asking a different questions: What skills can be expected from a user who tries to install a modified library on the device?
I agree with you that the installation instructions provided by AVM - after (!) they got sued - are enough. Anyone with basic skills in embedded Linux development should be able to follow these instructions. Manufacturers can expect a certain skill level from their users if they want to exercise their rights from (L)GPL. For example, users must provide an interface-compatible library.
I give my licensing customers the following rule of thumb. The build and installation instructions must not be more difficult than for the manufacturer's developers, but they don't have to be simpler either. The simplest solution is to provide the build and installation scripts and documents that the developers use - of course, with proprietary software stripped out. Manufacturers can't go wrong with this approach.
Therefore: No, your grandma need not be able to install a modified library on her Fritz!Box and the Javascript developer neither.
Cheers,
Burkhard
Well, I think the point that AVM was making when they take pains to say that the installation instructions were already publicly available is that the existing publicly available instructions _should have been_ enough. That is to say, "the developers of the Freetz project were able to do it without us holding their hands; perhaps you should have been able to also".
But more fundamentally, I think it's always important to take the results from non-binding settlements of lawsuits with several grains of salt. The suit was funded by the Software Freedom Conservancy; their interests are generally to get meaningful wins, either in the form of forcing companies to release previously closed software, getting companies to comply with FOSS licenses that they are out of compliance with, or to establish legal precedent supporting their maximalist interpretation of FOSS licenses. In this case, they got none of those things! They chose to settle when the only new thing they got out of AVM was a short how-to document explaining how to do something that was already documented publicly, and they withdrew all allegations of a GPL/LGPL violation. If they thought they had any kind of a case here, they would have pushed for more. So to me, this case rather looks like a loss for the SFC that they are trying very hard to spin as a win.
As for the legal costs, I suspect that AVM simply concluded that it was cheaper to pay the SFC's costs than to drag out the case arguing over who should pay. I could also speculate that the SFC may have agreed to settle only on the condition that AVM paid costs.