[GPL Violation] Vodafone (DE) -> ArCadyan -> Easybox 904 product

[Armijn Hemel]

SQUASHFS error: Filesystem uses "lzma" compression.
This is not supported
Any ideas how I could fix that?

On my Fedora 18 system I just ran unsquashfs. Works perfectly.

armijn

[Nils Faerber]

Hi,

Hi!

This discussion does seem more legal than technical; you'd get a more
suitable, bigger, audience there.
https://lists.gpl-violations.org/mailman/listinfo/legal

Yes, Ralph, I think you are right.
I set the reply-to to the legal list now - hopefully this is kept by
mailman.

Enrico and others interested: Please post more follow-ups concerning the
Vodafone Easybox case to the legal list.

Thanks!

Cheers, Ralph.

Cheers
nils

[Enrico Mioso]

First of all - I would like to thank you all so much for your help, patience,
time and passion.
Thank you a lot Neil - and don't worry - I understand perfectly that you're
doing this at your personal title, and for me, this is a beautiful thing! I
appreciate it a lot - and more than if you where talking aas a Vodafone
Spokesman.

I decided to write this new message from scratch, since I don't like so much
lines like

<some text>

.. sorry! :)
For me, the idea of analysing the software a little more is a very very good
idea - and I've been doing so last night, even if I haven't hear nothing from
the user who had the device.
I can already tell you that:
- the release is an OpenWrt Kamikaze (as already said)
- the are some firmware blobs probably related to LTE hardware and/or DSL one,
and those are not covered by the GPL, so they're out
- in many boot scripts, there are references to a company - "Vertical
Communications": no homepage, only the "2010" date

Then, the usual set of scripts and binaries that are not pertaining to OpenWrt
itself directly, but have no Copyright notices.
We don't have the U-Boot Boot Loader as now - and I honestly don't remember
what's the U-Boot License. It seems to me very likely a Lantiq-patched U-Boot.
In the firmware you can see lots of traces of Lantiq technology, including some
blobs firmware.

Thank you again for your support.

Enrico M.

[Arnt Karlsen]

On Sat, 22 Jun 2013 00:11:04 +0200 (CEST), Enrico wrote in message

Post by Enrico Mioso
First of all - I would like to thank you all so much for your help,
patience, time and passion.
Thank you a lot Neil - and don't worry - I understand perfectly that
you're doing this at your personal title, and for me, this is a
beautiful thing! I appreciate it a lot - and more than if you where
talking aas a Vodafone Spokesman.
I decided to write this new message from scratch, since I don't like
so much lines like

<some text>

.. sorry! :)
For me, the idea of analysing the software a little more is a very
very good idea - and I've been doing so last night, even if I haven't
hear nothing from the user who had the device.
- the release is an OpenWrt Kamikaze (as already said)
- the are some firmware blobs probably related to LTE hardware and/or
DSL one, and those are not covered by the GPL, so they're out

..easy now, shouldn't these binary blobs be identified by name, size,
date, checksum(s), copyright ownership, copyright license and file
owners statement on file purpose, so a judge "can judge for himself"?

Post by Enrico Mioso
- in many boot scripts, there are references to a company - "Vertical
Communications": no homepage, only the "2010" date
Then, the usual set of scripts and binaries that are not pertaining
to OpenWrt itself directly, but have no Copyright notices.
We don't have the U-Boot Boot Loader as now - and I honestly don't
remember what's the U-Boot License. It seems to me very likely a
Lantiq-patched U-Boot. In the firmware you can see lots of traces of
Lantiq technology, including some blobs firmware.
Thank you again for your support.
Enrico M.

[Neil Brown]

On 21 Jun 2013, at 15:12, Nils Faerber <***@dpin.de> wrote:

Enrico, Nils

Post by Nils Faerber
Please post more follow-ups concerning the
Vodafone Easybox case to the legal list

You are more than welcome to email your concerns to ***@vodafone.com, and I can try to find an appropriate contact within Vodafone DE?

Just please bear in mind that I don't work for Vodafone DE, nor do I have any knowledge of this particular product. (Similarly, when I post on this list, I do so in my personal capacity, as someone interested in the legal issues around FOSS, and not as an employee / spokesman of Vodafone.)


Best wishes,

Neil

__________

Neil Brown
***@neilzone.co.uk | http://neilzone.co.uk

[Nils Faerber]

Post by Neil Brown
Enrico, Nils

Hello Neil!

Post by Neil Brown

Please post more follow-ups concerning the Vodafone Easybox case to
the legal list

You are more than welcome to email your concerns to
within Vodafone DE?

Oh, that's excellent, many thanks for the hint and the very kind offer!
It is always very complicated to find the right people to talk to in
such large corporations.

Post by Neil Brown
Just please bear in mind that I don't work for Vodafone DE, nor do I
have any knowledge of this particular product. (Similarly, when I
post on this list, I do so in my personal capacity, as someone
interested in the legal issues around FOSS, and not as an employee /
spokesman of Vodafone.)

Of course.
And on a personal side I very much appreciate that you volunteer in this
matter.

Many thanks!


I think we need to do some more homework now, i.e. further analyse the
software, see which licenses and projects are involved and what
Vodafone's obligations would have been at the moment of releasing the
first product based upon it.
This should then serve well enough for you to find the appropriate
people within Vodafone and make them get in touch with us.

Would that work for you too?

Post by Neil Brown
Best wishes,
Neil

Viele Grüße
nils

[Nils Faerber]

Hello all!
OK, this gets interesting...

The device in question is the Vodafone EasyBox 904 LTE.

Its firmware can be downloaded from the already mentioned public
download link

http://media.vodafone.de/www/assets/software/FW904/UEfullimage_AT904L-01.07.bin

which sits behind a legal disclaimer

http://www.vodafone.de/business/hilfe-support/support-firmware-easybox-904-lte-modem_209581.html#rights

which pretty clearly already violates the GPL/LGPL licenses since it
denies the right to pass on the free software contained in the device.
And of course no mention about the free software contained.

The firmware "bin" file is a UBoot uImage format binary containing a
LZMA compressed SquashFS which can easily be uncompressed by the latest
SquashFS Utils.

Besides busybox (GPL) it contains at least a dozen of other components
that are also either GPL or LGPL licensed. A major one are large parts
of OpenWRT, in /etc/ one can find:

openwrt_version:
10.03.1-RC5

openwrt_release:
DISTRIB_ID="OpenWrt"
DISTRIB_RELEASE="10.03"
DISTRIB_CODENAME="backfire"
DISTRIB_DESCRIPTION="OpenWrt Backfire 10.03"


The manual (German) of the device which can be found here

http://media.vodafone.de/www/assets/pdf/hilfe-und-support/services/EasyBox_904_LTE_-_Handbuch_Stand_20.6.2012.pdf

reproduces on page 170 the full GPL version 3 license text but omits the
"written offer" to request the sourcecode and where to do so.

The manual also mentions a company
Astoria networks GmbH
Koelner Strasse 10b,
65760 Eschborn

as the manufacturer of the device. They again have a web page dedicated
to the EasyBox 904 LTE and open source sourcecodes contain therein

http://www.astorianetworks.com/astoria/Easybox%20904%20LTE.html

But there is no code! Just a "coming soon".
Same is BTW true for their other product, the "Livebox 2.1".


So for me the case is pretty clear now.

There is a *massive* GPL/LGPL violation going on.
Vodafone is ignoring the GPL/LGPL almost completely.
And the manufacturer "Astoria" has recognised that they need to offer
the sources but they do not do it either.

Since Vodafone is the company actually openly distributing the device
containing the compiled versions of the software and is also offering
the compiled version in the form of a binary file for public download
(see above) they are actively violating the GPL/LGPL.

Cheers
nils

Post by Neil Brown
Enrico, Nils

Post by Nils Faerber
Please post more follow-ups concerning the
Vodafone Easybox case to the legal list

Just please bear in mind that I don't work for Vodafone DE, nor do I have any knowledge of this particular product. (Similarly, when I post on this list, I do so in my personal capacity, as someone interested in the legal issues around FOSS, and not as an employee / spokesman of Vodafone.)
Best wishes,
Neil

[Neil Brown]

On 21 Jun 2013, at 23:29, Nils Faerber <***@dpin.de> wrote:

Nils, Enrico

Post by Nils Faerber
The device in question is the Vodafone EasyBox 904 LTE.

Thanks both for your email on this; I will forward it through to the German team when I am back in the office.

It looks as if there are a number of issues to investigate.

One thing which you have both picked up on is that this looks to be a product which Vodafone has sourced from a third party, rather than developed itself. The practical impact of this is that it is most likely that the product team will need to go back to the supplier, so I am grateful for the detailed information which you have provided. (I say this not as an excuse or defence, but to help with some context as to how a report of this nature would most likely be handled.)

Best wishes,

Neil

__________

Neil Brown
***@neilzone.co.uk | http://neilzone.co.uk

[Nils Faerber]

Hello all!
First of all, sorry for the cross-post to legal and tech but this
concerns both...

I just got a call from one of the developers of the Easybox from
Vodafone Germany! Many thanks also go to Neil for forwarding this within
Vodafone - it did reach the right people, as it seems.

Vodafone has recognised the GPL breach and, to what the contact said,
they very explicitely required correct GPL/LGPL handling from their
supplier but there seemed to be some "communication problem", he said.

Vodafone revisited the problem and now has a tar-ball of the sources!
Yeah!
And they ask if we could help them, as they did not develop the
software, to check if the tar-ball is complete.
Well, I think this is fair.

So I would like to ask here for some additional eyes to look on this
tar-ball? We would get a first version, can analyse it and comment on it
before Vodafone puts it up for public consumption.
I think up to three or four people would be nice.

Who would be willing to help?


He also said that the original firmware contains proprietary parts like
a SIP server. Vodafone originally had the plan to release two firmwares
- a proprietary one which is the one one gets when buying the product
and a "community edition", fully working and flashable but without the
proprietary parts.
I think this is excellent! But they currently still have legal concerns,
e.g. emergency dialling and such. But once the sources are out and we
get into good contact with them I think the community project will be
the logical next step.

Cheers
nils

Post by Nils Faerber
Hello all!
OK, this gets interesting...
The device in question is the Vodafone EasyBox 904 LTE.
Its firmware can be downloaded from the already mentioned public
download link
http://media.vodafone.de/www/assets/software/FW904/UEfullimage_AT904L-01.07.bin
which sits behind a legal disclaimer
http://www.vodafone.de/business/hilfe-support/support-firmware-easybox-904-lte-modem_209581.html#rights
which pretty clearly already violates the GPL/LGPL licenses since it
denies the right to pass on the free software contained in the device.
And of course no mention about the free software contained.
The firmware "bin" file is a UBoot uImage format binary containing a
LZMA compressed SquashFS which can easily be uncompressed by the latest
SquashFS Utils.
Besides busybox (GPL) it contains at least a dozen of other components
that are also either GPL or LGPL licensed. A major one are large parts
10.03.1-RC5
DISTRIB_ID="OpenWrt"
DISTRIB_RELEASE="10.03"
DISTRIB_CODENAME="backfire"
DISTRIB_DESCRIPTION="OpenWrt Backfire 10.03"
The manual (German) of the device which can be found here
http://media.vodafone.de/www/assets/pdf/hilfe-und-support/services/EasyBox_904_LTE_-_Handbuch_Stand_20.6.2012.pdf
reproduces on page 170 the full GPL version 3 license text but omits the
"written offer" to request the sourcecode and where to do so.
The manual also mentions a company
Astoria networks GmbH
Koelner Strasse 10b,
65760 Eschborn
as the manufacturer of the device. They again have a web page dedicated
to the EasyBox 904 LTE and open source sourcecodes contain therein
http://www.astorianetworks.com/astoria/Easybox%20904%20LTE.html
But there is no code! Just a "coming soon".
Same is BTW true for their other product, the "Livebox 2.1".
So for me the case is pretty clear now.
There is a *massive* GPL/LGPL violation going on.
Vodafone is ignoring the GPL/LGPL almost completely.
And the manufacturer "Astoria" has recognised that they need to offer
the sources but they do not do it either.
Since Vodafone is the company actually openly distributing the device
containing the compiled versions of the software and is also offering
the compiled version in the form of a binary file for public download
(see above) they are actively violating the GPL/LGPL.
Cheers
nils

Post by Neil Brown
Enrico, Nils

Post by Nils Faerber
Please post more follow-ups concerning the
Vodafone Easybox case to the legal list

Just please bear in mind that I don't work for Vodafone DE, nor do I have any knowledge of this particular product. (Similarly, when I post on this list, I do so in my personal capacity, as someone interested in the legal issues around FOSS, and not as an employee / spokesman of Vodafone.)
Best wishes,
Neil

[Enrico Mioso]

Hi guys!

I think it's beautiful! And - yes, I can help with this! And might be we will
try to re-build the firmware also, to flash it on the device!
And they should also give us some data to create the firmware acceptable by
u-boot.
thank you!!



On Thu, 27 Jun 2013, Nils Faerber wrote:

==Date: Thu, 27 Jun 2013 15:39:55 +0200
==From: Nils Faerber <***@dpin.de>
==To: ***@lists.gpl-violations.org
==Cc: Enrico Mioso <***@gmail.com>, ***@lists.gpl-violations.org
==Subject: Re: [GPL Violation] Vodafone (DE) -> ArCadyan -> Easybox 904 product
==
==Hello all!
==First of all, sorry for the cross-post to legal and tech but this
==concerns both...
==
==I just got a call from one of the developers of the Easybox from
==Vodafone Germany! Many thanks also go to Neil for forwarding this within
==Vodafone - it did reach the right people, as it seems.
==
==Vodafone has recognised the GPL breach and, to what the contact said,
==they very explicitely required correct GPL/LGPL handling from their
==supplier but there seemed to be some "communication problem", he said.
==
==Vodafone revisited the problem and now has a tar-ball of the sources!
==Yeah!
==And they ask if we could help them, as they did not develop the
==software, to check if the tar-ball is complete.
==Well, I think this is fair.
==
==So I would like to ask here for some additional eyes to look on this
==tar-ball? We would get a first version, can analyse it and comment on it
==before Vodafone puts it up for public consumption.
==I think up to three or four people would be nice.
==
==Who would be willing to help?
==
==
==He also said that the original firmware contains proprietary parts like
==a SIP server. Vodafone originally had the plan to release two firmwares
==- a proprietary one which is the one one gets when buying the product
==and a "community edition", fully working and flashable but without the
==proprietary parts.
==I think this is excellent! But they currently still have legal concerns,
==e.g. emergency dialling and such. But once the sources are out and we
==get into good contact with them I think the community project will be
==the logical next step.
==
==Cheers
== nils
==
==
==Am 22.06.2013 00:29, schrieb Nils Faerber:
==> Hello all!
==> OK, this gets interesting...
==>
==> The device in question is the Vodafone EasyBox 904 LTE.
==>
==> Its firmware can be downloaded from the already mentioned public
==> download link
==>
==> http://media.vodafone.de/www/assets/software/FW904/UEfullimage_AT904L-01.07.bin
==>
==> which sits behind a legal disclaimer
==>
==> http://www.vodafone.de/business/hilfe-support/support-firmware-easybox-904-lte-modem_209581.html#rights
==>
==> which pretty clearly already violates the GPL/LGPL licenses since it
==> denies the right to pass on the free software contained in the device.
==> And of course no mention about the free software contained.
==>
==> The firmware "bin" file is a UBoot uImage format binary containing a
==> LZMA compressed SquashFS which can easily be uncompressed by the latest
==> SquashFS Utils.
==>
==> Besides busybox (GPL) it contains at least a dozen of other components
==> that are also either GPL or LGPL licensed. A major one are large parts
==> of OpenWRT, in /etc/ one can find:
==>
==> openwrt_version:
==> 10.03.1-RC5
==>
==> openwrt_release:
==> DISTRIB_ID="OpenWrt"
==> DISTRIB_RELEASE="10.03"
==> DISTRIB_CODENAME="backfire"
==> DISTRIB_DESCRIPTION="OpenWrt Backfire 10.03"
==>
==>
==> The manual (German) of the device which can be found here
==>
==> http://media.vodafone.de/www/assets/pdf/hilfe-und-support/services/EasyBox_904_LTE_-_Handbuch_Stand_20.6.2012.pdf
==>
==> reproduces on page 170 the full GPL version 3 license text but omits the
==> "written offer" to request the sourcecode and where to do so.
==>
==> The manual also mentions a company
==> Astoria networks GmbH
==> Koelner Strasse 10b,
==> 65760 Eschborn
==>
==> as the manufacturer of the device. They again have a web page dedicated
==> to the EasyBox 904 LTE and open source sourcecodes contain therein
==>
==> http://www.astorianetworks.com/astoria/Easybox%20904%20LTE.html
==>
==> But there is no code! Just a "coming soon".
==> Same is BTW true for their other product, the "Livebox 2.1".
==>
==>
==> So for me the case is pretty clear now.
==>
==> There is a *massive* GPL/LGPL violation going on.
==> Vodafone is ignoring the GPL/LGPL almost completely.
==> And the manufacturer "Astoria" has recognised that they need to offer
==> the sources but they do not do it either.
==>
==> Since Vodafone is the company actually openly distributing the device
==> containing the compiled versions of the software and is also offering
==> the compiled version in the form of a binary file for public download
==> (see above) they are actively violating the GPL/LGPL.
==>
==> Cheers
==> nils
==>
==>
==> Am 21.06.2013 18:54, schrieb Neil Brown:
==>> On 21 Jun 2013, at 15:12, Nils Faerber <***@dpin.de> wrote:
==>>
==>> Enrico, Nils
==>>
==>>> Please post more follow-ups concerning the
==>>> Vodafone Easybox case to the legal list
==>>
==>> You are more than welcome to email your concerns to ***@vodafone.com, and I can try to find an appropriate contact within Vodafone DE?
==>>
==>> Just please bear in mind that I don't work for Vodafone DE, nor do I have any knowledge of this particular product. (Similarly, when I post on this list, I do so in my personal capacity, as someone interested in the legal issues around FOSS, and not as an employee / spokesman of Vodafone.)
==>>
==>>
==>> Best wishes,
==>>
==>> Neil
==>
==
==
==--
==Viele Gr??e
== nils faerber
==

[Armijn Hemel]

Could depend on what kernel you have. I don't think the kernel had
squashfs lzma support until 2.6.38.

My kernel has no squashfs support. Unsquashfs is a pure userspace tool.

armijn

[Michael Jack Kaczynski]

Could depend on what kernel you have. I don't think the kernel had
squashfs lzma support until 2.6.38.

Post by Armijn Hemel

SQUASHFS error: Filesystem uses "lzma" compression.
This is not supported
Any ideas how I could fix that?

On my Fedora 18 system I just ran unsquashfs. Works perfectly.
armijn

[Phillip Lougher]

Hi,

Sorry, this won't be threaded because I only just subscribed, but, I
wanted to clear up some possible confusion.

Post by Armijn Hemel

Could depend on what kernel you have. I don't think the kernel had
squashfs lzma support until 2.6.38.

Kernel 2.6.38 added support for xz (lzma2) compression, there has
never been a mainline kernel which supported "lzma" compression.

Post by Armijn Hemel
My kernel has no squashfs support. Unsquashfs is a pure userspace tool.

Yes, Unsquashfs supports lzma compression, and distribution binaries
may support it depending on what options the distribution maintainer
choose. If the Unsquashfs in your distribution of choice doesn't
support it, then you can download the source code and compile it
yourself.

The latest release is 4.2 from 2011 which is pretty ancient, it can be
downloaded from Squashfs.sourceforge.net. The development git
repository is https://git.kernel.org/cgit/fs/squashfs/squashfs-tools.git,
which contains a much more modern version.

A little bit of history may explain why there is no mainline kernel
which supports lzma compression. I produced a squashfs-tools and
kernel implementation of lzma (lzma1) for Squashfs 4.0 in 2010. This
format unfortunately did not live long (or prosper) because Linus
Torvalds rejected the kernel code in 2010, mainly because the existing
lzma1 kernel code is a mess and my patch unfortunately brought that to
his attention, with the response the existing code is a mess and I
don't want to accept any changes until it is cleaned up (the actual
response was more "colourful"). Unfortunately the existing code was
impossible to clean up, and so lzma compressed filesystems were
effectively history from then on.

I added xz compression (lzma2) a year later which went into mainline
in 2.6.38. But it is evident a number of companies in the meantime
picked up my lzma patches and produced systems using them. For this
reason Squashfs-tools retains the ability to read and produce lzma
compressed filesystems, although its use is deprecated.

As far as the kernel patches is concerned (if you want to produce a
kernel that can mount lzma compressed filesystems), my patches should
still be available in archives of the linux kernel mailing list. I
did have a git repository that contained these patches on kernel.org,
but this got destroyed when kernel.org got hacked (kernel.org came
back online with no original repositories, and I've seen no reason to
put it back). If you want these patches and don't want to look back
though the mailing list archives for them, then I do have a copy of
the original repository somewhere, which I can give you if you email
me privately.

Phillip

Post by Armijn Hemel
armijn