The Fantec decision: German court holds distributor responsible for FOSS compliance

jeremy · 07-30-2013, 12:42 PM

Quote:

The GPLv2 continues to be the most widely used FOSS license, but has been rarely interpreted by courts. Most of these decisions have come from Germany as a result of the enforcement actions of Harold Welte. The recent Fantec decision in Germany is the latest such decision and provides guidance on the requirements for companies to manage their use of FOSS and the lack of ability to rely on statements from their suppliers.

Fantec, a European company, distributed a media player with a Linux-based firmware inside. Like many companies, Fantec used software from third parties. The firmware of the media player included the iptables software which is licensed under the GPLv2. Fantec provided a version of the source code of the firmware for download that they had received from their Chinese manufacturer. Harald Welte is one of the authors of the iptables software and has brought suit a number of times to enforce the GPLv2 for this software. Welte had settled a prior violation by Fantec with respect to violation of the GPLv2. As a result Fantec signed a cease-and-desist-declaration in 2010 and Fantec was contractually obliged to refrain from further GPLv2 violations (and otherwise to pay a contractual penalty).

The software available for download for the Fantec product was reviewed during a "Hacking for Compliance Workshop" in Berlin organized in 2012 by Free Software Foundation Europe. The hackers discovered that the source code provided by Fantec did not include the source code for the iptables software and that the source code for some other components did not match the versions used to compile the binary code of the firmware.

In 2012, the plaintiff gave Fantec notice of another GPLv2 violation and admonished Fantec to cease the infringement and to pay the contractual penalty and the out-of-court costs for legal prosecution. Fantec objected that it had been assured by his Chinese supplier that the source code received from the supplier was complete. And Fantec claimed that they had investigated options with third parties for source code analysis and had been informed that such reviews were quite expensive and not completely reliable. Welte raised two arguments. First, Fantec provided source code that was incomplete. And, second, that the source code was not the correct version.

On June 14, 2013, the district court of Hamburg found that Fantec violated the obligation in the GPLv2 to provide to its customers the "complete corresponding source code" of the software. The court affirmed a violation of the GPLv2 license conditions because the iptables code was not contained within the source code provided by Fantec. However, the court did not rule on the second argument that the source code was not up to date. Consequently, the decision does not provide significant guidance on the definition of the term "complete corresponding source code."

More at OpenSource.com...

--jeremy