Confusion after lawsuit against AVM over Fritzbox firmware

Developer Sebastian Steck, with the support of the Software Freedom Conservancy (SFC), has filed a lawsuit against router manufacturer AVM for releasing additional source code in accordance with the LGPL. The proceedings ended without any decision. Stake withdrew its lawsuit and AVM covered the legal costs. All sides see themselves as winners.

Advertisement

The reason for the lawsuit was that Stake was unable to convert, compile, and upload libraries to the FritzBox 4020 using the source code of the FritzBox 4020’s firmware which was made available to the AVM server upon request. Stake specifically wanted to adapt the uClibc library, licensed under the LGPL. According to the developer, there are problems at many places. Since, in Stake’s opinion, AVM did not respond adequately to requests for allegedly missing source code components and information needed for compilation, the developer filed a lawsuit and brought SFC on board for support.

Lawsuit settled after AVM was adjusted

A few months after the lawsuit was filed, AVM provided Stake with the information it needed for its purposes. For example, unspecified environment variables must be KERNEL_LAYOUT Value drgfly Included so that kernel sources can be compiled. Furthermore, there is AVM made instructionsWith which files in the existing firmware image can be exchanged and the converted image can be moved to the Fritzbox. For this purpose, for example, AVM also uses tools from the Fritz project.

Another part of the lawsuit was whether it was sufficient to allow modified software to run in the device’s RAM or whether permanent modifications should be possible for users. The instructions issued by the AVM during the process make the latter possible. This means that this question has not been legally clarified.

JBL Bar 5.0 Multibeam in testing

The voices of those involved in the process

Steck reported online that the information enabled him to translate the LGPL libraries and install the resulting .so binary files on the Fritzbox. He and the SFC then announced the lawsuit had been settled and AVM agreed to cover the legal costs. What was not part of the lawsuit and remains unclear is the management of GPL sources. Therefore, how these sources can be compiled, including the Linux kernel, has not been made clear.

SFC’s Denver Gingerich told Heise Online that the AVM has not published complete sources on its website. Control scripts for compilation and installation were missing. These were released only for the Fritzbox model 4020 during the process and may Download from SFC website – As part of overall firmware sources. Steak also has the script compile_06.83.sh Published, allowing sources to be translated.

When asked, AVM emphasized that the company “has been actively supporting the open source community for years, because it ensures long-term innovation and during the process it turned out that the source code was sufficient, that’s The reason being that the other party has waived all allegations regarding potential LGPL/GPL-infringement.” When asked specifically about SFC’s contradictory representation, the company further explained that while this was a private individual’s lawsuit, “SFC has never been involved in the legal proceedings against AVM.” Regarding the assumption of legal costs, AVM also discusses: “Since a private individual has filed the suit here, who has withdrawn the suit and AVM is interested in an amicable outcome of the legal proceedings, we have voluntarily assumed the court costs. It has been decided to make the payment.”

The company continued, therefore, that SFC’s representation is false; AVM has already requested the correction. For example, AVM points out that other developers of free software, such as the popular Fritz and OpenWRT projects, had no problems with Fritzbox sources, even in 2021. The error messages the plaintiff received were more indicative of inexperience with cross-compiling procedures. For example, no cross-compilers were found in the paths of his development system. The environment variable determining the target architecture was not set, even though it could have been obtained from easily available source code.

Legally, nothing was clarified in this process regarding compliance with the sources and requirements of the LGPL and GPL licenses. However, the result is more easily accessible and implementable instructions.

(DMK)