From mboxrd@z Thu Jan 1 00:00:00 1970 From: Robin Getz Date: Mon, 29 Jun 2009 11:17:29 -0400 Subject: [U-Boot] U-book and GPLv3? (fwd) In-Reply-To: References: <20090618145128.69F27832E416@gemini.denx.de> Message-ID: <200906291117.29372.rgetz@blackfin.uclinux.org> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de On Thu 25 Jun 2009 10:41, Detlev Zundel pondered: > Hi Mike, > > >>> It is this "certification is only possible like we say" attitude > >>> which I seriously question. > >> > >> whether you question this attitude doesnt matter. you arent a lawyer > >> in general, you arent a lawyer for these companies, and you arent > >> indemnifying them. their legal review says that it's a requirement, > >> so it is now a requirement for the software. anything beyond that > >> is irrelevant. > > > > Now was this so hard? This is actually an important fact that it is a > > legal requirement for a company - thanks. > > As a quick web research did not help, if this is a legal requirement, > then can you point me to the law which requires such a thing? As Mike said - there are many organisations which require this. Some from a legal standpoint, some from a certification standpoint. It depends on the end product. Your ability not to find them doesn't change the fact that they do exist. Search for: IEC 61508-3 : Functional safety of E/E/PE safety-related systems Part 3: Software requirements http://en.wikipedia.org/wiki/IEC_61508 IEC 601-1-4 : Safety Requirements for Programmable Electronic Medical Systems ANSI/UL 1998 : Standard for Safety Software in Programmable Components There are other that are industry specific - the gambling industry is a good one (that ksi already pointed out) http://gaming.nv.gov/stats_regs/reg14_tech_stnds.pdf > 1.080 Control program requirements. > (a) Employ a mechanism approved by the chairman which verifies that all > control program components, including data and graphic information, are > authentic copies of the approved components. The chairman may require tests > to verify that components used by Nevada licensees are approved components. > The verification mechanism must have an error rate of less than 1 in 10 to > the 38th power and must prevent the execution of any control program > component if any component is determined to be invalid. That doesn't use the words secure boot - but if that is what the chairman of the Nevada gaming commision decides - then that is what is is... As Mike has stated - we work on many devices who's products would fall under the GPL 3's ?User Products? category - who's manufactures have told us "No GPL3". They have this right - the right to use the software - or the right to choose something else. They have indicated they will exercise this right - so far - I believe them. If Wolfgang decides to remove all the "GPL-2 only" code, and re-write that, and release U-Boot under GPL-3 - that is his right - he needs to do the things that let him sleep better at night. If he decides to do so - it just means that I will need to exercise my rights - and either fork, or go work on MicroMonitor - neither are really that appealing for me - but they are the only choice I have with a GPL-3 U-Boot. Part of any freedom is the freedom to have an amicable disagreement, and make an alternative choice. I will only need to make that choice when I see a commit to: http://git.denx.de/cgi-bin/gitweb.cgi?p=u-boot.git;a=blob;f=COPYING;hb=HEAD which updates it to GPL3. Until then - it is just time wasted, when I should be doing more productive things. :) -Robin Although this is a bad analogy for the existing topic - I have always told my kids - part of freedom is the right to make choices, and allow others to make choices you don't agree with. If you choose to believe your water bottle is some sort of deity, and want to worship it - that is fine. I'll stand up and defend your rights to do so. I will still think you are nuts and will not join you in your water bottle worship (no offence meant to any existing, future or past water bottle worshippers). Freedom does not mean "my freedom" - it is not my right to enforce my belief system on you, but my obligation to stand and defend your rights to do something I don't like. Pushing one's person's belief system on another belongs in comp.sys.mac.advocacy and no where else.