Allwinner Caught Obfuscating Their Improperly Licensed Code

[oliver]

As I posed on the ML, I'm not terribly convinced this is Allwinner (the company)'s intentional thing. I'm more imagining an engineer, that wrote the cedarX stuff* and is very protective of his work, telling management that this is his (Allwinner's) IP and they need to protect it. So management may follow. Or he is even working out of his own hand (shared github account). The fact that the functions where obfuscated to 'hide' stuff, is really a bad bad thing and does show intent. Even so, I'm betting on the rogue engineer, rather then Allwinner's intent. This information just has to get to the proper people via the proper channels.

*
If you take the JPEG stuff, what it looks like is they took the stock jpeg library, and at a certain point changed some functions to interface with cedarX. I can very much image, that the the other half of the code, was modified so that it could be embedded into the chip. (C -> FPGA isn't the hardest job I imagine). If there is some way to prove this, they can obfuscate and change all they want, but the GPL infringment is then in the SoC too. Granted, I think you can do with libjpeg whatever you want, if you add the readme (they didn't), but there are gpl-ed functions in there aswell.

[curaga]

I can explain the whole process in a whole detail, because I was directly
involved in the process of this decision and I can tell where this is going
right now:
The rename was done to fix the LGPL violations by adding a wrapper for the
GPLed libraries which will be LGPLed and published.
This way we have Binary<->LGPLed open source code<->GPL libraries
Next step will be to drop the whole "we ship our own SDK"-thing and move over
to stream our code into the existing open source alternatives.
But until the FOSS libraries have all the functionality from the shipped SDK
we can not just stop supporting our customers in China.
Also we can not suddenly make it open source for the following reasons:
* Some engineers and managers do not fully comply with the GPLing
of their code yet.
* The code has awful coding style and my armcc refuses to compile at least 2/3
of the code because of the Chinese comments.
* Also some of the engineers obviously have never heard the term "revision
control" which makes it even harder to locate the actual version of the
source code from which the binary was compiled from... -.-'

Cheers
David

An Allwinner employee's account.

[nanonyme]

I'm not sure that works. Afaik when you link the LGPL wrapper against a GPL library, your wrapper becomes GPL automatically as defined in LGPL terms. After that the wrapper will be pointless

[curaga]

I've not checked the specifics, but ffmpeg is LGPL. If they use the distro's ffmpeg, it will be legal even if the ffmpeg build includes GPL codecs.

[gigaplex]

I've not checked the specifics, but ffmpeg is LGPL. If they use the distro's ffmpeg, it will be legal even if the ffmpeg build includes GPL codecs.

Not in this case. LGPL requires that you don't modify it (or provide source for the modifications), and they're clearly modifying it in the obfuscation process at the very least. I think there are also some limitations with linking, some argue that static linking the code also requires distributing the source of what you link against, while dynamic linking doesn't have that requirement. They're not dynamic linking to the distro ffmpeg due to the aforementioned obfuscation.

[curaga]

Did you read the quote? They're in progress of moving it to dynamic linking.

[dragorth]

Did you read the quote? They're in progress of moving it to dynamic linking.

They have already shipped a product with this in it. They are now required by the GPL, which is an agreement they made when they chose to use it, to open the code they shipped. There are no exceptions in the GPL, without going to the stakeholders, in this case the programmers, and asking for an exemption.

[nanonyme]

Not in this case. LGPL requires that you don't modify it (or provide source for the modifications), and they're clearly modifying it in the obfuscation process at the very least. I think there are also some limitations with linking, some argue that static linking the code also requires distributing the source of what you link against, while dynamic linking doesn't have that requirement. They're not dynamic linking to the distro ffmpeg due to the aforementioned obfuscation.

Ah, yeah, good point. Didn't think of the two levels of dynamic linking option. Sounds messy as heck though. There's also the thing though that why would any sane person use a company's products with that awful programming practices that the guy told about

[dragorth]

Ah, yeah, good point. Didn't think of the two levels of dynamic linking option. Sounds messy as heck though. There's also the thing though that why would any sane person use a company's products with that awful programming practices that the guy told about

Well, to hear most companies that are talking about open sourcing their software, they all have software that bad, and they generally go through a cleanup phase.

This is one of the arguments they use for not open sourcing their software, due to the work. This is one of the benefits espoused by open source proponents, that open source code is higher quality because it is out in the open.

So, just picture it, the majority of the shipped code in your devices is bad enough they don't want you to see it.

[Isedonde]

The rename was done to fix the LGPL violations by adding a wrapper for the
GPLed libraries which will be LGPLed and published.

They can't LGPL a GPL library. If it's GPL, no dynamic linking hacks can solve their issue of having to GPL their own product that uses a GPL library. Unless there is some loophole that can be used against the intended meaning of the GPL. Or maybe it's a typo?

This way we have Binary<->LGPLed open source code<->GPL libraries

That's not allowed. This linking forces the combination to be licensed under GPL: [LGPL code <-> GPL libraries]
So what they want to do is: [Binary <-> GPL libraries] which is only allowed if their binary is licensed under GPL, so they have to provide sources and allow modification, redistribution etc.

But until the FOSS libraries have all the functionality from the shipped SDK
we can not just stop supporting our customers in China.

I can not just stop stealing money from my bank. You know, I really need that money! I can not just stop supporting my own needs.

Also we can not suddenly make it open source for the following reasons: (3 reasons why Allwinner code is horrible)

Yeah, those are really good reasons for breaking THE LAW.



Note that this was an indirect quote, and not written by curaga.. Looks a little strange this way, sorry curaga. :-)