[U-Boot] U-book and GPLv3? (fwd)

[Robin Getz]

On Thu 25 Jun 2009 10:41, Detlev Zundel pondered:
> Hi Mike,
> 
> >>> It is this "certification is only possible like we say" attitude
> >>> which I seriously question.
> >>
> >> whether you question this attitude doesnt matter.  you arent a lawyer
> >> in general, you arent a lawyer for these companies, and you arent
> >> indemnifying them.  their legal review says that it's a requirement, 
> >> so it is now a requirement for the software.  anything beyond that
> >> is irrelevant. 
> >
> > Now was this so hard?  This is actually an important fact that it is a
> > legal requirement for a company - thanks.
> 
> As a quick web research did not help, if this is a legal requirement,
> then can you point me to the law which requires such a thing?

As Mike said - there are many organisations which require this. Some from a 
legal standpoint, some from a certification standpoint. It depends on the end 
product.

Your ability not to find them doesn't change the fact that they do exist.

Search for:

  IEC 61508-3 : Functional safety of E/E/PE safety-related systems
                 Part 3: Software requirements
                http://en.wikipedia.org/wiki/IEC_61508

  IEC 601-1-4 : Safety Requirements for Programmable Electronic
                 Medical Systems

  ANSI/UL 1998 : Standard for Safety Software in Programmable Components


There are other that are industry specific - the gambling industry is a good 
one (that ksi already pointed out)

http://gaming.nv.gov/stats_regs/reg14_tech_stnds.pdf
> 1.080 Control program requirements.
>    (a) Employ a mechanism approved by the chairman which verifies that all
> control program components, including data and graphic information, are
> authentic copies of the approved components. The chairman may require tests
> to verify that components used by Nevada licensees are approved components.
> The verification mechanism must have an error rate of less than 1 in 10 to
> the 38th power and must prevent the execution of any control program
> component if any component is determined to be invalid.

That doesn't use the words secure boot - but if that is what the chairman of 
the Nevada gaming commision decides - then that is what is is...



As Mike has stated - we work on many devices who's products would fall under 
the GPL 3's “User Products” category - who's manufactures have told us "No 
GPL3". They have this right - the right to use the software - or the right to 
choose something else. They have indicated they will exercise this right - so 
far - I believe them.

If Wolfgang decides to remove all the "GPL-2 only" code, and re-write that, 
and release U-Boot under GPL-3 - that is his right - he needs to do the 
things that let him sleep better at night. 

If he decides to do so - it just means that I will need to exercise my 
rights - and either fork, or go work on MicroMonitor - neither are really 
that appealing for me - but they are the only choice I have with a GPL-3 
U-Boot. Part of any freedom is the freedom to have an amicable disagreement, 
and make an alternative choice.

I will only need to make that choice when I see a commit to:
http://git.denx.de/cgi-bin/gitweb.cgi?p=u-boot.git;a=blob;f=COPYING;hb=HEAD
which updates it to GPL3.

Until then - it is just time wasted, when I should be doing more productive 
things. :)

-Robin



Although this is a bad analogy for the existing topic - I have always told my 
kids - part of freedom is the right to make choices, and allow others to make 
choices you don't agree with. If you choose to believe your water bottle is 
some sort of deity, and want to worship it - that is fine. I'll stand up and 
defend your rights to do so. I will still think you are nuts and will not 
join you in your water bottle worship (no offence meant to any existing, 
future or past water bottle worshippers). 

Freedom does not mean "my freedom" - it is not my right to enforce my belief 
system on you, but my obligation to stand and defend your rights to do 
something I don't like. 

Pushing one's person's belief system on another belongs in 
comp.sys.mac.advocacy and no where else.