GPL 2 Firmware and the Apache Code That Cannot Go In

A lot of firmware is licensed under GPL version 2, because it’s built on Linux, BusyBox or U-Boot, and a lot of it says “version 2 only”. That choice shuts out more code than people expect. Apache 2.0 code can’t go in, even though Apache is permissive. GPL version 3 code can’t go in either, even though it’s the GPL. The same Apache code would be fine in an MIT product and the GPL-3.0 code in a GPL-3.0 one, so a function that’s harmless in one of your products can be a problem in another.

Remixware checks copied code against your project’s licence, so it catches these. The test project that comes with it includes a small firmware tree under GPL-2.0-only with three copied files, and here’s what it reports:

Three copies in a GPL-2.0-only firmware tree: an Apache-2.0 retry helper and a GPL-3.0-or-later sort function marked as conflicts, and a zlib string buffer that needs its notice kept.

CONFLICT             tools/retry/retry.go:5-39
                     example.com/retrykit, retry.go:12-50 (Apache-2.0), copied with edits, 100% match
                     Apache-2.0 code can't go into a GPL-2.0-only project: the two licences
                     conflict over patents.

CONFLICT             tools/sortnames/main.go:10-37
                     example.org/gplsort, natural.go:56-84 (GPL-3.0-or-later), copied with edits, 89% match
                     GPL-3.0-or-later code and GPL-2.0-only code can't be combined in one program.

ATTRIBUTION MISSING  src/strbuf.c:2-30
                     upstream/cstr, strbuf.c:2-30 (Zlib), copied with names changed, 100% match
                     Don't claim you wrote it, mark it as changed if you changed it, and keep the
                     zlib notice in the source.

Why Apache 2.0 Doesn’t Fit

The Apache License 2.0 includes patent terms: a patent licence from the contributors, which ends for anyone who sues over those patents. GPL version 2 doesn’t allow adding conditions like that to the code it covers, so the Free Software Foundation considers the two incompatible. GPL version 3 was written to accept the Apache terms, which is why the same Apache code would be fine in a GPL-3.0 project.

Why GPL-3.0 Doesn’t Fit Either

Each version of the GPL requires the whole program to be released under that version. A program can’t be under version 2 only and version 3 at once, so code that is “version 3 or later” and code that is “version 2 only” can’t be combined. Code under “version 2 or later” avoids the problem, because it can move to version 3 with the rest.

What to Do

For the conflicts, the choices are to take the code out, write the function again without copying it, or find the same thing under a licence that fits, such as a BSD or MIT library. If your own code says “GPL-2.0-or-later”, tell Remixware with --license GPL-2.0-or-later or in .remixware.json, and both conflicts turn into questions for you instead: that code fits once the firmware as a whole goes out under version 3, which is a decision to make. Until your notices carry their copyright lines and licence texts, they show as missing attribution, and after that as findings to review. The zlib finding is the easy one. Keep the original notice in the source file, mark it as changed, and don’t present it as your own work.

Remixware reads your licence from the COPYING or LICENSE file at the top of the tree, and the licence of each source from its own files. It flags licensing questions; it isn’t legal advice, and for firmware that ships in hardware, a lawyer’s look at the conflicts is cheap compared with a recall.