Re: [Suit] Firmware Update Paper

[Michael Richardson <[e-mail]>]

David Brown <[e-mail]> wrote:
    > On Fri, Nov 29, 2019 at 12:46:42PM +0100, Emmanuel Baccelli wrote:

    >> The open source implementation stemming from our paper [1] is embedded
    >> into the RIOT operating system, which is indeed licensed with LGPL.
    >> The implementation is compliant with draft-ietf-suit-manifest-00 and
    >> has recently been merged into the main branch of RIOT, see [2].  Reuse
    >> and further contributions to this code base are welcome!
    >> 
    >> Relicensing this code is not planned as far as I know (@ code
    >> co-authors: please correct me if I'm wrong).

    > This is fine.  The authors of the code are free to license the code
    > however they wish.  I just want to make sure it is clear that this code
    > is not useful as a general example, and if the SUIT wishes to have
    > reference code, it will need to be licensed differently.

If by reference code, do you mean code that people look at while doing their own
proprietary code under a more restrictive license?
Is the issue that those authors can't read LGPL code because lawyers feel they
will become "tainted"?  

My experience with 2-clause BSD/MIT licensed reference code is that they get
turned into products, not used as "reference".  They aren't used as a
"reference", but as prototype code.  Companies fix bugs, do not contribute the
fixes back, and then the actual base "reference" code actually becomes known
to be non-compliant. 

    > One example is that both Zephyr and MCUboot are licensed under the
    > Apache 2.0 license.  Most parties feel that the Apache 2.0 and the LGPL
    > 2 license are incompatible, and this code cannot be linked together
    > into a single product.  Since I'd like to include SUIT support into
    > MCUboot, this means I'll have to be doing an implementation from
    > scratch.

But, you can still read the code, and you can still benefit from test vectors.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [