BusyBox Creators Sue Extreme Networks

EddieC 0 Tallied Votes 276 Views Share

Erik Anderson and Rob Landley are at it again. The guys who brought us the BusyBox toolset for resource-constrained Linux and Unix systems, together with the Software Freedom Law Center, have filed yet another GPL enforcement lawsuit for copyright infringement.

This time it’s against Extreme Networks Inc., a maker of high-performance network switches and other connectivity and communications gear. Without even reading the complaint, I would put my money on the FSLC; the previous four such cases resulted in out-of-court settlements in favor of the plaintiffs. In those cases, defendents were ordered to distribute source code in compliance with the GPL 2. They’re also looking for damages and litigation costs.

According to the five-part complaint, which was filed July 17 in the United States District Court in New York, a judgement is sought against Extreme Networks be immediately “enjoined and restrained from copying, modifying, distributing or making any other infringing use of Plaintiff’s software.” Also sought is that the Extreme “account for and disgorge to Plaintiffs all profits derived by Defendant from its unlawful acts.” Good luck with that one.

"We attempted to negotiate with Extreme Networks, but they ultimately ignored us," said Aaron Williamson, SFLC Counsel. "Like too many other companies we have contacted, they treated GPL compliance as an afterthought. That is not acceptable to us or our clients."

In a related story, BusyBox has agreed to end its lawsuit against Super Micro Computer, which manufactures and distributes computers and PC components. In exchange for dismissing the suit, “Supermicro has agreed to appoint an Open Source Compliance Officer within its organization to monitor and ensure GPL compliance, to publish the complete and corresponding source code for the version of BusyBox it previously distributed, and to undertake substantial efforts to notify previous recipients of BusyBox from Supermicro of their rights to the software under the GPL,” according to an SFLC news release. The settlement also includes an undisclosed financial consideration for the plaintiffs.

Dani AI

Generated

As notes, enforcement actions around BusyBox are a practical reminder: distributing devices with copyleft code carries enforceable obligations. The GNU GPLv2 requires that when you ship object code you also make the "complete corresponding source" available or provide the written offer described in section 3; the FSF FAQ explains how rights and reporting work. GNU GPL v2 (text)FSF GPL FAQ. (gnu.org)

Quick, practical steps for teams auditing products: build an authoritative inventory of shipped components; run an automated SCA against images and firmware to find GPL code; for firmware images, extract filesystems (for example with binwalk) and then scan the extracted tree with a license scanner such as ScanCode or an enterprise SCA product. These steps let you locate BusyBox binaries, identify version/configuration, and collect the build scripts and patches you’ll need for a compliant source package. Using Open Source Code — Linux Foundation guideScanCode Toolkit docsBinwalk. (linuxfoundation.org)

If noncompliance is found, remediate in this order: identify the exact BusyBox version/config used; assemble the corresponding, machine‑readable source (including build/config scripts); publish the source or a valid written offer per GPLv2; include license text and prominent notices in distributed materials; and adopt repeatable processes (OSPO/Compliance program, SBOMs/SPDX) so the issue does not recur. OpenChain and Linux Foundation materials give practical frameworks for creating policies and roles. [GPL howto / packaging guidance] — [OpenChain spec] — [Linux Foundation compliance resources]. (gnu.org)

This is practical, not legal, guidance: if a claim is received, involve legal counsel early and take prompt, documented corrective steps — showing good faith and a remediation program materially reduces risk and cost. The resources above point to accepted technical and process remedies that vendors use to get back into compliance. (gnu.org)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.