Category: My Blog

When you crack open a new embedded Linux gadget—whether it’s a router, a smart camera, or an industrial IoT gateway—you’re not just holding hardware. You’re holding a bundle of open-source software, and a lot of it is covered by the GPL. That license isn’t a suggestion. It’s a binding set of requirements. Yet after years of tearing down consumer and industrial gear, I’ve seen that many manufacturers treat the GPL like an afterthought. This isn’t about legal nitpicking. It’s about supply chain integrity, security, and the right to fix what you own. A proper GPL audit is a technical process, not a philosophical one. Here’s how you do it, step by step, from the first glance at the box to the final compliance report. Why a GPL Audit Matters for…

How I Reconstructed a Buildable GPL Source Release From a Vendor's Incomplete Tarball // FIELD GUIDE The vendor's email landed on a Tuesday afternoon. One sentence, a download link, and a 247 MB tarball named linux-source-v2.3.1-release.tar.gz. Six weeks of GPL source requests, and the Chinese ODM behind a white-label industrial IoT gateway we were auditing had finally delivered. I downloaded the archive, extracted it, stared at the contents for about ninety seconds. What they sent us was not a source release. It was a funeral. The tarball had a Linux kernel source tree—correctly versioned at 5.10.110, with the right SoC patches for the Rockchip RK3568—but it was missing every artifact that makes kernel source buildable. No Makefile at the root. No scripts/ directory. No .config, no defconfig, no toolchain definitions.…

If you're holding a piece of industrial IoT hardware or a consumer router and wondering whether the vendor is actually honouring the GPL, the only way to know for sure is to open it up and look. Not at the marketing slicks. Not at the shrink-wrap license. At the firmware. At the build scripts. At the exact kernel configuration that shipped on the device. I've spent the better part of a decade doing exactly this—tearing down embedded Linux products, diffing kernel sources, and catching the shortcuts that manufacturers hope nobody will notice. This is a concrete, step-by-step audit methodology that moves from physical inspection to filesystem forensics, and it ends with a clear verdict: compliant, or not. Why a GPL Audit Matters for Industrial and Consumer Devices Embedded Linux is…

What GPL Compliance Actually Means in the Embedded World The GNU General Public License isn't a polite request. When a vendor ships a Linux-based device—a router, a smart camera, an industrial controller—they're legally on the hook to provide the source code for the GPL-licensed components they distribute. Yet in the embedded space, compliance is often an afterthought, buried under marketing deadlines and a deep-seated fear of opening up proprietary bits. This guide is for the engineers, tinkerers, and legally curious hackers who want to move past a company's word and verify what's really running inside a sealed box. We'll walk through a concrete, repeatable audit process that starts with a shrink-wrapped product and ends with a documented compliance report. The GPL's core demand is straightforward: distribute a binary, and you…

What Is a GPL Compliance Audit and Why Does It Matter? A GPL compliance audit is a methodical dissection of a device’s software distribution to see if it actually honors the GNU General Public License. The GPL is a copyleft license—it gives users the freedom to run, study, share, and modify the software. In return, anyone shipping GPL-licensed code inside a product must hand over the corresponding source, build scripts, and installation info. This isn’t a polite request. It’s a legal condition baked into the license itself. For embedded Linux engineers and open-hardware people, auditing a device is a direct challenge to proprietary lock-in. It reveals whether a manufacturer respects user freedom or hides behind binary blobs and half-baked source drops. This article lays out a practical, evidence-driven audit process.…

How I Reconstructed a Vendor's Incomplete GPL Source Release Using Binary-to-Source Forensic Mapping By Arjun Mehta · GPL Devices Six weeks after my formal request, the tarball arrived. It was labeled linux-source-5.10-rk3568-v1.2.tar.gz, weighed 1.4 GB, and looked plausible at first glance. The vendor—a Shenzhen-based ODM selling a white-label industrial gateway under at least three different brand names—had technically fulfilled their GPLv2 obligation. They sent me source code. But when I extracted the archive and attempted a build, the story fell apart. No build.sh. No Yocto layer. No Buildroot defconfig. The device tree sources were absent—only a compiled .dtb blob sitting in a prebuilt/ directory. The U-Boot SPL was missing entirely. A README file contained two lines: Build with make. Contact support for questions. I had a kernel source tree that…

What a GPL Compliance Audit Actually Means Let’s cut through the noise. A GPL compliance audit isn’t some abstract legal exercise—it’s a hands-on forensic dig into the software a device ships with. You’re checking whether the manufacturer respected the GNU General Public License. For embedded Linux engineers, this means pulling apart firmware, examining bootloaders, and sifting through whatever source code the vendor bothered to release. The GPL gives users the right to run, study, share, and modify the software on their own hardware. When a company slaps GPL code—like the Linux kernel, BusyBox, or U-Boot—into a product and then locks it down, they’re breaking that agreement. That’s not just a legal misstep; it’s a direct attack on the open hardware ecosystem. This guide is about gathering hard evidence, not just…

Understanding the GPL and Why Audits Matter The GNU General Public License is the legal backbone that keeps the open-source world standing. It guarantees that software stays free—free to study, modify, and share. For embedded devices like routers, smart appliances, and industrial controllers, the GPL draws a hard line: ship a product with GPL code inside, and you must provide the corresponding source. This isn't a polite request. It's a copyright-backed obligation. I've spent years tearing apart firmware and sitting across the table from manufacturers during compliance negotiations, and I can tell you that most slip-ups come from sloppy internal tracking, not deliberate evasion. Still, the result is the same—users get locked out of the code they should rightfully have. A thorough audit is the only way to confirm a…

If you’ve just bought a router, smart camera, or any gadget that hums with Linux inside, you’re holding more than hardware. You’re holding a bundle of rights under the GNU General Public License. The GPL says you’re entitled to the complete, buildable source code that makes the device tick. Yet plenty of manufacturers still ship products without it—sometimes because they’re sloppy, sometimes because they’re hoping nobody asks. A careful audit cuts through the fog. Here’s how to go from blinking lights to a clear picture of whether your device respects your software freedom. Understanding the GPL Compliance Obligations Both GPLv2 and GPLv3 demand that anyone distributing binary software hand over the “complete corresponding source” when asked. For an embedded box, that’s not just a tarball of the Linux kernel. It…

Why GPL Audits Matter for Embedded Devices Every Linux-based router, smart camera, or IoT widget that ships with GPL-licensed code comes with strings attached. The GNU General Public License isn't just a block of legalese you click through—it's a technical contract. If a manufacturer distributes a device with, say, the Linux kernel or BusyBox inside, they're on the hook to provide the complete corresponding source code. When they don't, an audit is how you prove it. I've spent years tearing apart firmware images and going back and forth with vendors who'd rather pretend the GPL doesn't exist. The pattern is almost always the same: they slap together some open-source components, toss in proprietary drivers, and ship the product without a word about source availability. A proper audit doesn't just spot…