I am looking at using a processor module that initializes using Coreboot and SeaBIOS to make an embedded hardware product. Assuming we move forward, Coreboot/SeaBIOS will load our (proprietary) OS. Our OS contains no GPL licensed code.

We have never used GPL licensed code in our products before. And, I am having a hard time seeing how we can do so and comply with GPLv2, or GPLv3 for that matter.

I have read this page https://www.softwarefreedom.org/resources/2008/compliance-guide.html several times, a number of other sites, as well as reading the GPLv2 itself.

I do not want to impose a GPLv2 requirement on our customers if they use our product. I want GPLv2 compliance to be fully our responsibility. If we do have to impose a GPLv2 requirement on our customers to use a Coreboot/SeaBIOS initialized platform, we probably cannot use such a platform in any product, which would be quite unfortunate from my point of view.

A large fraction of our customers are OEMs or VARs and they make products of their own that use our products as a part. Unless they pull the system apart, the end-use customer often does not even know one of our products is part of the system they buy, though our licensing to our customer (OEM) does require that the reseller maintain our copyright notice in their system documentation or software copyright notice or they do not have a right to distribute our software. The copyright for the hardware is printed on the hardware itself, as is customary. The OEM who uses our product configures our product before it ships to the end-use customer, and they often build additional hardware of their own as part of the system. The OEM (our customer) almost always includes a PC and custom software of their own as part of the end-use system. The end use customer may later re-sell their system to yet another end-use customer or even pull our product out of the system and resell that separately (on eBay, say).

If I have understood correctly, all of these owners of our product must have access to exactly the Coreboot/SeaBIOS source used to produce the binary in the copy of our product they own.

Based on my understanding so far (highly limited), the only way that looks like it might be possible to avoid propagating a GPLv2 requirement to our customers – and thus making the compliance fully our responsibility - would be if we distribute a copy of the exact source code used to build the module’s Coreboot/SeaBIOS configuration as an integral part of our product. If there is any way to do it, we would actually rather not develop the expertise to set up such a build, but I see no way around being able to build our own version of the system image if we are to comply with GPLv2. My understanding is that we have to know exactly how to build the exact binary we distribute and we have to be able to tell a technically competent recipient of the binary how to do that build themselves, as well as how to incorporate the new build into our product. We do not have to support any changes whatsoever, but we do have to support the initial process of re-configuring our product with a newly built binary that came from the sources we supply as long as there are no changes made to those sources.

One idea I had is to put the source on a microSD drive and semi-permanently attach that drive to the product. That way the Coreboot/SeaBIOS code would go along for the ride any time our product changed hands (as long as no one lost it). The microSD would not be part of our product. So, an owner of our product (and so a recipient of the binary distribution of Coreboot/SeaBIOS) would have the code on the microSD, but we have no easy way to provide them access to its content. But, they could remove the microSD from the product and read it from any machine that can read a microSD. That means almost any machine.

That seems to me like it might cover the source distribution requirement of GPLv2, though I am not quite certain it is good enough.

However, so far, it looks impossible to me to meet the GPLv2 notification requirements. And, I do not understand at all how the likes of network routers that use GPL licensed code can possibly comply either.

I can imagine fitting a URL, such as www.mstarlabs.com/GPL (not a real URL) on to the product to point any owner of the product to an explanation of where to find the license text and source for Coreboot/SeaBIOS. The microSD would have everything needed to comply on it, but I do not think that comes close to meeting the notice requirements of GPL.

Under Windows, where we sell the vast majority of our systems, we do have a control panel application that every user could potentially get to. And, it could include a screen that explains the owner’s GPL rights and where to find the source microSD on the product. But, we have no means to force the user to look at the control panel application, and most users would never have any reason to do so.

Do you have any written guidelines that explain how to properly – and legally - distribute a commercial hardware product that incorporates Coreboot/SeaBIOS? In particular, how can we meet the notification requirements when the user never even physically handles the product, sees any output from the device, or installs any software on it? I am having a hard time figuring out how to do this, if it is possible at all.

If this is the wrong forum for this kind of question, I apologies. And, I would appreciate if someone could point me to an appropriate forum.

Ian Lewis