Hello all,
every now and then a new round of discussions about the U-Boot licensing terms comes to boil. As I started this project nearly 15 years ago, and still regularly participate in it's development processes, I've been asked to comment on this topic. Here we go:
Legal disclaimer: I am speaking for myself only. I do not claim to represent the opinion of the community, nor that of my employer, DENX.
Short answer / management summary: ----------------------------------
The U-Boot project uses version 2 of the GNU General Public License as published by the Free Software Foundation as general license.
This is version 2 only, not version 3, not even "version 2 or any later version”.
There are no plans nor any ongoing activities to change that.
Any attempts to re-license U-Boot under a different license (say, GPL-3.0 [1]) would require an enormous amount of efforts. I have never seen any indications that any entity would be willing to start any such development or pay for the necessary efforts.
Long answer including background information: ---------------------------------------------
U-Boot is a community project, and development is driven by contributions from the community.
There may be a large number of source files in the U-Boot project which are coyrighted by me, but that does not mean much. I am just a small part of this community.
No individual entity, person or company, has sole power of representation so he could decide which direction the development takes. They can submit proposals and patches, but that does not mean that the community will automatically accept these. They can even create forks of the U-Boot project, but again it is up to the community to decide what constitutes the "mainline" version of U-Boot that is supported by the community. In the end it is up for the community to decide what is considered best and what will be publicly accepted.
The project wide license for U-Boot is GPL-2.0. Individual files are covered by other, compatible licenses, but the license for the U-Boot image that you will install and run on your devices is GPL-2.0.
If anybody wanted to change this licensing, that would require considerable efforts. Assume we attempt to make the smallest possible change: open the path for later versions of the GPL, i. e. introduce GPL-2.0+ as general U-Boot license. That would mean that all files in U-Boot that are currently covered by GPL-2.0 only whould need to be either removed, relicenced by their respective authors, or reimplemen- ted from scratch. This affects a LOT of code. U-Boot was created with the explicit intention to borrow as much code from the Linux kernel as possible. And that was done. And Linux is licensed unter GPL-2.0. In the result, not only a lot of individual files, but whole sub-systems in U-Boot are covered by GPL-2.0: whole MTD / UBI / UBIFS as well as most other file system code, many device drivers, large parts of the networking code, etc. etc. So what are the options?
- If we remove all such code, U-Boot would no longer compile or fail to boot on the overwhelming majority of supported systems - and on the remaining ones the functionality would be so crippled to render it basically unusable. - Trying to contact all individual authors who contributed parts to the GPL-2.0 code in U-Boot would be not only a Sisyphean task, but it would also be bound to fail, as some of the involved authors have clearly delcared in the past that they refuse to do so. - So remains reimplementing all these missing parts from scratch, and getting it into a usable state on the plethora of systems supported by U-Boot. That would be a tremendous effort, worth probably several man-years of development. So far, nobody ever even came close to seriously considering such a venture.
So U-Boot is stuck with status quo - it's licensed under GPL-2.0.
But why are there any discussions at all? What could be reasons that would eventually motivate the community to change the status quo of U-Boot licensing?
License terms have always been a somewhat controversial issue. This is unavoidable, as there are many different interests. Just to give two examples:
1. Device Owner:
Assume there is a developer who has been actively contributing to the development of U-Boot for a number of years, dedicating a significant amount of efforts to the community. Then he buys some device, and quickly finds out:
- There is an annoying bug or problem or limitation of functio- nality in the device, and the vendor is not going to fix that. - The device is running U-Boot, and the bug is in the vendor provided U-Boot code. You can easily verify this because the vendor prvides the full source code of U-Boot as required by GPL. - The problem is trivial to fix, for example simply by upgrading to a more recent version of U-Boot. - It is impossible to install a different version of U-Boot on the device, because the device accepts only cryptographically signed versions of U-Boot, and the vendor does not provide access to the keys needed for signing any custom version.
So even though it's your own code running on the device you own, and you have full access to the source code, you are still locked out, unable to fix the problems you are suffering from.
I think it is perfectly comprehensible if such a device owner would much rather have that U-Boot was licensed under GPL-3.0, where the vendor would have to provide access to the keys needed to create images that can be installed on the device.
I.e., there are very good reasons why we should switch to GPL-3.0 as soon as possible.
2. Device Manufacturer:
Assume there is a manucacturer of devices that are deployed in "sensitive areas". This is a wide area - here is just a short list of (real life) examples what this could include:
- Smart Meters: You don't want to anybody mess with your account, or gets access to data you consider private. - Fire detector and burglar detection systems: Private or even public scurity would suffer if someone could install hacked software. - Medical equipment: Human health and even lifes could be at risk if modified software is running. - Gaming machines: A lot of money could be at stake if other than the officially approved code could be made to run. ...
I think it is perfectly comprehensible that GPL-3.0 is totally unacceptable to such a device manufacturer.
I.e., there are very good reasons never ever to switch to GPL-3.0.
Obviously we have a conflict here, that neither GPL-2.0 nor GPL-3.0 can resolve. It appears there is not (at least not yet) any licensing model that could cover all interests. So what can we do?
Actually we can do very little. It boils down to two things:
- Hoping that some later version of the GPL might be able to cover the gap of interests so it would be considered a usable alternative by the majority of the community. [There is no doubt that GPL-3.0 is not able to do that.] - Making sure that any future project for such a relicensing will not be made even harder that it already is; this is why we ask that ``all new code that gets added to U-Boot shall use a "GPL-2.0+" SPDX-License-Identifier.''
Actually it is probably this latter clause which fuels discussions about an imminent switch to GPL-3.0. None of these discussions (at least none that I am aware of) have any rational background, though; in many cases they ware just caused by misunderstandings or mis- information, and in some events they were attempts to spread FUD.
In reality, there is no reason for excitement: U-Boot is licensed under GPL-2.0, and as far as I can tell it it will main so, at least in the foreseeable future.
January 2015, Wolfgang Denk
[1] In this text, I use the SPDX License Tags as used within the hole U-Boot source code to refer to specific license terms; please see [2] for details.
[2] http://git.denx.de/?p=u-boot.git;a=blob;f=Licenses/README
Best regards,
Wolfgang Denk