Subject: Re: [Suit] Firmware Update Paper

From: David Brown <[email-masked]>
Date: Wed, 27 Nov 2019 13:36:51 -0700

On Wed, Jul 24, 2019 at 05:44:06PM +0000, Hannes Tschofenig wrote:

> Secure Firmware Updates for Constrained IoT Devices Using Open Standards: A
> Reality Check”
> 
> [1]https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=8725488

There seems to be a prototype implementation mentioned in the paper.
However, this code seems to be covered by a LGPL license, which
prevents it from being used in many (arguably most) IoT embedded
applications.

Is there any chance this code could be released under a friendlier
license for this market, such as Apache 2.0?  Otherwise, at least for
MCUboot, we will likely end up having to do a from-scratch
implementation without referencing this code.

Thanks,
David

---

From: Emmanuel Baccelli <[email-masked]>
Date: Fri, 29 Nov 2019 12:46:42 +0100

Hi David, all,

The open source implementation stemming from our paper [1] is embedded into
the RIOT operating system, which is indeed licensed with LGPL.
The implementation is compliant with draft-ietf-suit-manifest-00 and has
recently been merged into the main branch of RIOT, see [2].
Reuse and further contributions to this code base are welcome!

Relicensing this code is not planned as far as I know (@ code co-authors:
please correct me if I'm wrong).

Related: we know of several companies, big and small, which use RIOT in
their IoT products (and thus use software including -- but not limited to
-- LGPL code) and they are quite happy with it.

Cheers,
Emmanuel

[1] https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=8725488
[2] https://github.com/RIOT-OS/RIOT/tree/master/examples/suit_update

On Wed, Nov 27, 2019 at 9:37 PM David Brown <[email-masked]> wrote:

> _______________________________________________
> Suit mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/suit
>

---

From: David Brown <[email-masked]>
Date: Fri, 29 Nov 2019 11:36:27 -0700

On Fri, Nov 29, 2019 at 12:46:42PM +0100, Emmanuel Baccelli wrote:

> The open source implementation stemming from our paper [1] is embedded into the
> RIOT operating system, which is indeed licensed with LGPL.

This is fine.  The authors of the code are free to license the code
however they wish.  I just want to make sure it is clear that this
code is not useful as a general example, and if the SUIT wishes to
have reference code, it will need to be licensed differently.

> Related: we know of several companies, big and small, which use RIOT in their
> IoT products (and thus use software including -- but not limited to -- LGPL
> code) and they are quite happy with it.

I'm sure there are a few companies that are willing to use LGPL
licensed embedded code, but their existence doesn't negate that there
are large numbers of users who will be unable to use (or even look at)
this code.

One example is that both Zephyr and MCUboot are licensed under the
Apache 2.0 license.  Most parties feel that the Apache 2.0 and the
LGPL 2 license are incompatible, and this code cannot be linked
together into a single product.  Since I'd like to include SUIT
support into MCUboot, this means I'll have to be doing an
implementation from scratch.

It's not my place to argue about the licensing of RIOT, but I would
like to see reference code for SUIT that can be used as widley as
possible, and the licensing of this particular code prevents it from
being used for that.

David

---

From: Michael Richardson <[email-masked]>
Date: Fri, 29 Nov 2019 14:28:27 -0500

>> The open source implementation stemming from our paper [1] is embedded
    >> into the RIOT operating system, which is indeed licensed with LGPL.
    >> The implementation is compliant with draft-ietf-suit-manifest-00 and
    >> has recently been merged into the main branch of RIOT, see [2].  Reuse
    >> and further contributions to this code base are welcome!
    >> 
    >> Relicensing this code is not planned as far as I know (@ code
    >> co-authors: please correct me if I'm wrong).

    > however they wish.  I just want to make sure it is clear that this code
    > is not useful as a general example, and if the SUIT wishes to have
    > reference code, it will need to be licensed differently.

If by reference code, do you mean code that people look at while doing their own
proprietary code under a more restrictive license?
Is the issue that those authors can't read LGPL code because lawyers feel they
will become "tainted"?  

My experience with 2-clause BSD/MIT licensed reference code is that they get
turned into products, not used as "reference".  They aren't used as a
"reference", but as prototype code.  Companies fix bugs, do not contribute the
fixes back, and then the actual base "reference" code actually becomes known
to be non-compliant. 

    > Apache 2.0 license.  Most parties feel that the Apache 2.0 and the LGPL
    > 2 license are incompatible, and this code cannot be linked together
    > into a single product.  Since I'd like to include SUIT support into
    > MCUboot, this means I'll have to be doing an implementation from
    > scratch.

But, you can still read the code, and you can still benefit from test vectors.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [