Re: [Buildroot] FW: Buildroot Licensing Issue Uncovered

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello Chris,

Adding Yann E. Morin and Alexandre Belloni in the loop. See further
below for some feedback.

On Tue, 8 Aug 2023 23:01:40 +0000
"chris.wood@lmco.com" <chris.wood@lmco.com> wrote:

> We are desiring to use the buildroot software version 2023-5 and were
> performing a licensing scan for the purpose of creating Software Bill
> of Material and came across a reference to a license that is not an
> open-source license it is an NXP Semiconductor commercial license.
> The licensed file is located in the boot/directory/lpc3200cdl, and
> the file containing the license reference is
> "0002-delete_redundant_files.patch". The reference says:
>
> "- * Software that is described herein is for illustrative purposes only
> - * which provides customers with programming information regarding the
> - * products. This software is supplied "AS IS" without any warranties.
> - * NXP Semiconductors assumes no responsibility or liability for the
> - * use of the software, conveys no license or title under any patent,
> - * copyright, or mask work right to the product. NXP Semiconductors
> - * reserves the right to make changes in the software without
> - * notification. NXP Semiconductors also make no representation or
> - * warranty that such application will be suitable for the specified
> - * use without further testing or modification."
>
> To obtain clarification on the statement "...conveys no license or
> title under any patent, copyright, or mask work right to the
> product..." we asked NXP who responded that the software is freeware
> offered to customers purchasing their boards, and that it is not
> open-source software and furthermore stated that they have no
> relationship to the buildroot software product and wondered if you
> have an agreement with them allowing you to include it in your
> software.
> 
> We are hoping that you can provide licensing permission evidence or
> other actions that will be taken to clear up this oversight so that
> we may use your software without concern.

Thanks for getting this to our attention, very interesting.

A first point of clarification is that we do *not* include lpc32xxcdl
in our software. Buildroot can download it and build it from you, but
from a licensing perspective, lpc32xxcdl is *not* distributed as part
of Buildroot. It would be distributed as part of the embedded Linux
system you build with Buildroot, if you have enabled lpc32xxcdl in your
configuration.

Another aspect is that the lpc32xxcdl package is quite old, and back
then we did not include license information about the packages: you can
see that boot/lpc32xxcdl/lpc32xxcdl.mk does not have any LICENSE or
LICENSE_FILES variables like most of our packages now have. This means
that lpc32xxcdl has been added at a time (2012) when license review
was not done in a systematic fashion like it is done today for all new
packages that come in.

I am not a lawyer nor a legal person, but I agree that the words "NXP
Semiconductors assumes no responsibility or liability for the use of
the software, conveys no license or title under any patent, copyright,
or mask work right to the product" are very unclear in what they allow
to do with the software.

Are you using lpc32xxcdl in particular in your product?

Based on the unclear wording of the license terms of lpc32xxcdl and the
fact that LPC3250 is a very old platform and there hasn't been much (if
any) interest about it for many years, I would be inclined to say that
we should simply drop this package from Buildroot.

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot