[Suit] Reference implementation of SUIT manifest parsing

[David Brown <[e-mail]>]

At the last hackathon, work was done on implementations of the SUIT
manifest format.  One way to describe this kind of work would be as a
reference implementation: something that could be a starting point for
anyone wishing to use SUIT to develop something.

However, I had to limit my involvement in this effort, because some of
the code being used was covered under the LGPL 2.0.

I'm wondering if it would be useful to develop equivalents of this
code under a license that would be usable by a larger audience.  I'm
actually having a pretty hard time understanding how there is any
audience for bootloader code covered under the LGPL.

A few of the reasons that the LGPL doesn't work for me (and I believe
doesn't work for many of the current uses).

  - The FSF considers the Apache 2.0 license to be incompatible with
    the GPLv2 (including the LGPL).

  - The Apache Software Foundation considers GPLv3 to be compatible in
    only one direction (Apache 2.0 code can be linked into an
    otherwise GPLv3 application, but GPLv3 code cannot be brought into
    an Apache 2.0 project).

  - The Apache Software Foundation considers the GPLv2 (including
    LGPL) to be incompatible with the Apache 2.0 license.

  - By Mynewt and Zephyr are licensed under the Apache 2.0 license.
    Mynewt is an Apache project and would fall under their constraints
    of forbidding the including of any code under a GPL license.  The
    Zephyr project requires included code to be under the Apache 2.0
    license, and occasionally will allow other more liberal licensed
    code to be included.

Regardless of the above, I see a conflict between the LGPLv2
requirement that the user be able to modify the LGPLv2 licensed code,
and the general purpose of SUIT to enforce that only authorized images
run on the device.  One of the purposes of a signed manifest is to
restrict the very action that the LGPLv2 requires.

My conclusions:

  - libcose (and any other LGPLv2 code) cannot be used by Zephyr,
    Mynewt, due to policies by these projects.  At best, it would end
    up being something that end users would have to incorporate, and
    SUIT support would not be able to become standard support on these
    platforms.

  - libcose (and any other LGPLv2 code) cannot be used by Zephyr,
    Mynewt, mbed OS, and MCUboot, due to incompatibility between the
    LGPLv2 and the Apache 2.0 license.  (Specifically, I do not
    believe the current mbed OS SUIT work is allowed).

  - Very few of our end users would want to meet the LGPLv2
    requirement allowing end users to replace the firmware.
    Specifically, those users desiring signed manifests to ensure only
    authorized images can be run are likely intending to prohibit end
    users from running their own versions of the code.

I've tried to avoid even looking at the libcose code (and making sure
to look at licenses carefully) since it seems likely that I, or
someone working on Zephyr or MCUboot) will need to implement COSE
support in order to support SUIT.

David