{% extends "base_conservancy.html" %}

{% load cache %}

{% load humanize %}

{% block head %}

<link href="/jquery-ui.css" rel="stylesheet" type="text/css"/>

<link href="/forms.css" rel="stylesheet" type="text/css"/>

{% endblock %}

{% block outercontent %}

<div class="content-with-donate-sidebar">

    <div id="container">

            <h2>What We Do</h2>

            {% include 'submenus/what_we_do_partial.html' %}

            <ul>

            </ul>

         </div>

         <div id="mainContent">

           {% block content %}

           <h1>What We Do</h1>

           <p>Software Freedom Conservancy is a nonprofit organization

           centered around ethical technology. Our mission is to ensure the

           right to repair, improve and reinstall software. We promote and

           defend these rights through fostering free and open source

           software (FOSS) projects, driving initiatives that actively make

           technology more inclusive, and advancing policy strategies that

             defend FOSS (such as copyleft).</p>

           <p>Our work on <a href="/copyleft-compliance/">copyleft

           compliance</a>, including enforcement of the General Public

           License (GPL), is world-renowned.  We believe fundamentally that

           copyleft licenses are the best tool available today to empower

           users and consumers to take control of their electronic devices,

           liberate themselves from planned obsolesce, and join a free market

           where they choose who provides their software.</p>

           <p>We also believe that FOSS functions best when built by a

           egalitarian community in which hobbyists, volunteers, and

           individuals stand on equal footing with companies and large

           organizations.  Vendor neutrality is simply not enough — as

           that merely makes companies equal to each other and leaves

           hobbyists and volunteers out in the cold.  To foster FOSS creation

           in this manner, we are the <a href="/projects/">non-profit home to

           dozens of member projects and initiatives</a> whom we assist to

           remain transparent and prioritize the public good in their

           development of FOSS.</p>

           <p>Furthermore, diversity and inclusion is a critical component to

           egalitarian FOSS communities.  We acknowledge that FOSS

           communities historically have struggled on these fronts and the

           myth of “pure meritocracy” so popular in FOSS circles

           willfully ignores the systemic biases in our societies and

           cultures.  We are thus the proud home of

           the <a href="https://outreachy.org/">Outreachy initiative</a> that

           offers paid internships in FOSS for contributors who have faced

           systemic bias in their efforts to join the FOSS community.<p>

           {% endblock %}

               </div>

    </div>

           {% endblock %}

{% extends "base_compliance.html" %}

{% block subtitle %}Copyleft Compliance Projects - {% endblock %}

{% block content %}

<h1 id="ourwork">Conservancy's Copyleft Compliance Projects</h1>

<p>As existing donors and sustainers know, the Software Freedom Conservancy

  is a 501(c)(3) non-profit charity registered in New York, and Conservancy

  helps people take control of their computing by growing the software

  freedom movement, supporting community-driven alternatives to proprietary

  software, and defending free software with practical initiatives.

  Conservancy accomplishes these goals with various initiatives, including

  defending and upholding the rights of software users and consumers under

  copyleft licenses, such as the GPL.</p>

<p>Free and open source software (FOSS) is everywhere and in everything; yet

our software freedom is constantly eroded.  With the help of its

volunteers, <a href="/members/current/">member projects</a>,

and <a href="/about/staff/">staff</a>, Conservancy stands up for users'

software freedom via its copyleft compliance work.</p>

<p>Conservancy's primary work in copyleft compliance currently focuses on

our <a href="/copyleft-compliance/enforcement-strategy.html">Strategic GPL

Enforcement Initiative</a>.  This initiative, <a href="/news/2020/oct/01/new-copyleft-strategy-launched-with-ARDC-grant/">launched in October 2020</a>,

represents the culmination of nearly 15 years of compliance work of

Conservancy spanning ten different fiscally sponsored projects, past lawsuits

against more than a dozen defendants, and hundreds of non-litigation

compliance actions.</p>

<p>For these many years, Conservancy has always given the benefit of the

  doubt to companies who exploited our good nature and ultimately simply

  ignore the rights of users and consumers.  In that time, the compliance

  industrial complex has risen to a multi-million-dollar industry —

  selling (mostly proprietary) products, services, and consulting to

  companies.  Yet, these compliance efforts ignore consistently the most

  essential promise of copyleft — the complete, Corresponding Source

  and “the scripts used to control compilation and installation of the

  executable&rdquo;.</p>

<p>We encourage our sustainers and software freedom enthusiasts everywhere to

  <a href="/copyleft-compliance/enforcement-strategy.html">read our detailed

  strategic plan for GPL enforcement</a> and its companion

  project, <a href="/copyleft-compliance/firmware-liberation.html">our

    Firmware Liberation Project</a>.</p>

<h2 id="projects">Compliance Relationship to Fiscally Sponsored Projects</h2>

<p>Historically, Conservancy was well-known for its ongoing license

compliance efforts on behalf of its BusyBox member project.  Today,

Conservancy does semi-regular compliance work for its BusyBox, Git, Inkscape,

Mercurial, Samba, QEMU and Wine member projects.  If you are a copyright

holder in any member project of Conservancy, please contact the project's

leadership committtee,

via <a href="mailto:PROJECTNAME@sfconservancy.org">&lt;PROJECTNAME@sfconservancy.org&gt;</a>

for more information on getting involved in compliance efforts in that

project.

</p>

<h2 id="linux">GPL Compliance Project For Linux Developers</h2>

<p>In May

2012, <a href="/news/2012/may/29/compliance/">Conservancy

launched</a> the <cite>GPL

Compliance Project for Linux Developers</cite>, which handles compliance and

enforcement activities on behalf of more than a dozen Linux copyright

holders.</p>

<p>The GPL Compliance Project for Linux Developers is comprised of copyright

holders in the kernel, Linux, who have contributed to Linux under its

license, <a href="http://www.gnu.org/licenses/gpl-2.0.html">the

GPLv2</a>. These copyright holders have formally asked Conservancy to engage

in compliance efforts for their copyrights in the Linux kernel.  In addition,

some developers have directly assigned their copyrights on Linux to Conservancy,

so Conservancy also enforces the GPL on Linux via its own copyrights in Linux.</p>

<p>Linux copyright holders who wish to assign copyright to or sign an enforcement agreement with

Conservancy should

  contact <a href="mailto:linux-services@sfconservancy.org">&lt;linux-services@sfconservancy.org&gt;</a>.

  In 2016,

  Conservancy <a href="/news/2016/nov/03/linux-compliance-agreements/">made

    public the template agreements used as part of this project</a>; both the

  <a href="/docs/blank_linux-enforcement-agreement.pdf">non-anonymous</a> and

  <a href="/docs/blank_anonymous-linux-enforcement-agreement.pdf">anonymous</a>

  versions are available.  However, please <strong>do not</strong> sign these

  unilaterally without contacting and discussing

  with <a href="mailto:linux-services@sfconservancy.org">&lt;linux-services@sfconservancy.org&gt;</a>

  first.</p>

<h2 id="debian">The Debian Copyright Aggregation Project</h2>

<p>In August 2015, <a href="/news/2015/aug/17/debian/">Conservancy announced the Debian Copyright Aggregation

Project</a>.  This project allows Debian contributors to assign copyrights to

Conservancy, or sign enforcement agreements allowing Conservancy to enforce

Free and Open Source (FOSS) licenses on their behalf.  Many Debian contributors

have chosen each of these options already, and more continue to join.</p>

<p>Debian contributors who wish to assign copyright to or sign an enforcement agreement with

Conservancy should contact <a href="mailto:debian-services@sfconservancy.org">&lt;debian-services@sfconservancy.org&gt;</a>.</p>

{% block subtitle %}Copyleft Compliance Projects - {% endblock %}

{% block content %}

<h1>Software Freedom Conservancy files right-to-repair lawsuit against California TV manufacturer Vizio Inc. for alleged GPL violations</h1>

<h2>Litigation is historic in nature due to its focus on consumer rights, filing as third-party beneficiary</h2>

<p><strong>FOR IMMEDIATE RELEASE</strong></p>

<p>IRVINE, Calif. (Oct. 19, 2021) Software Freedom Conservancy announced today

it has filed a lawsuit against Vizio Inc. for what it calls repeated failures

to fulfill even the basic requirements of the General Public License (GPL).</p>

<p>The lawsuit alleges that Vizio’s TV products, built on its SmartCast system,

contain software that Vizio unfairly appropriated from a community of

developers who intended consumers to have very specific rights to modify,

improve, share, and reinstall modified versions of the software.</p>

<p>The GPL is a copyleft license that ensures end users the freedom to run,

study, share, and modify the software. Copyleft is a kind of software

licensing that leverages the restrictions of copyright, but with the intent

to promote sharing (using copyright licensing to freely use and repair

software).</p>

<p>Software Freedom Conservancy, a nonprofit organization focused on ethical

technology, is filing the lawsuit as the purchaser of a product which has

copylefted code. This approach makes it the first legal case that focuses on

the rights of individual consumers as third-party beneficiaries of the GPL.

<p>&ldquo;That’s what makes this litigation unique and historic in terms of

defending consumer rights,” says Karen M. Sandler, the organization’s

executive director.</p>

<p>According to the lawsuit, a consumer of a product such as this has the

right to access the source code so that it can be modified, studied, and

redistributed (under the appropriate license conditions).</p>

<p>&ldquo;We are asking the court to require Vizio to make good on its

  obligations under copyleft compliance requirements,” says

  Sandler. She explains that in past litigation, the plaintiffs have always

  been copyright holders of the specific GPL code. In this case, Software

  Freedom Conservancy hopes to demonstrate that it's not just the copyright

  holders, but also the receivers of the licensed code who are entitled to

  rights.</p>

<p>The lawsuit suit seeks no monetary damages, but instead seeks access to

the technical information that the copyleft licenses require Vizio to provide

to all customers who purchase its TVs (specifically, the plaintiff is asking

for the technical information via “specific performance” rather

than &ldquo;damages&rdquo;).</p>

<p>&ldquo;Software Freedom Conservancy is standing up for customers who are

  alienated and exploited by the technology on which they increasingly

  rely,” says Sandler, adding that the lawsuit also aims to help

  educate consumers about their right to repair their devices as well as show

  policy makers that there are mechanisms for corporate accountability

  already in place that can be leveraged through purchasing power and

  collective action.</p>

<p>Copyleft licensing was designed as an ideological alternative to the

classic corporate software model because it: allows people who receive the

software to fix their devices, improve them and control them; entitles people

to curtail surveillance and ads; and helps people continue to use their

devices for a much longer time (instead of being forced to purchase new

ones).</p>

<p>&ldquo;The global supply chain shortages that have affected everything

from cars to consumer electronics underscore one of the reasons why it is

important to be able to repair products we already own,” says

Sandler. “Even without supply chain challenges, the forced obsolescence

of devices like TVs isn’t in the best interest of the consumer or even the

planet. This is another aspect of what we mean by ‘ethical

technology.’ Throwing away a TV because its software is no longer

supported by its manufacturer is not only wasteful, it has dire environmental

consequences. Consumers should have more control over this, and they would if

companies like Vizio played by the rules.&ldquo;</p>

<p>According to Sandler, the organization first raised the issue of

non-compliance with the GPL with Vizio in August 2018. After a year of

diplomatic attempts to work with the company, it was not only still refusing

to comply, but stopped responding to inquiries altogether as of January 2020.</p>

<p>&ldquo;By July 2021, the TV model that we originally complained was

non-compliant was discontinued,” says Sandler. “When we purchased new models,

we found that despite our efforts they still had no source code included with

the device, nor any offer for source code. People buying these models would

never know that there was anything special about the software in these

devices, or that they had any rights whatsoever connected with the software

{% extends "base_compliance.html" %}

{% block subtitle %}Copyleft Compliance Projects - {% endblock %}

{% block content %}

<h1 id="contribution-and-similarity-analysis-of-christoph-hellwigs-linux-code-as-found-in-vmware-esxi-5.5">Contribution and Similarity Analysis of Christoph Hellwig's Linux Code as found in VMware ESXi 5.5</h1>

<p>This analysis verifies by reproducible analysis a set of specific contributions that are clearly made by Christoph Hellwig to Linux, and shows how those contributions appear in the VMware ESXi 5.5 product.</p>

<p>This analysis was prepared and written by <a href="/about/staff/#bkuhn">Bradley M. Kuhn</a>.</p>

<h1 id="understanding-code-similarity-and-cloning">Understanding Code Similarity and &quot;Cloning&quot;</h1>

<p>Software is often modified in various ways; indeed, Linux developers form a community that encourages and enables modification by many parties. Given this development model, communities often find it valuable to determine when software source code moves from one place to another with only minor modifications. Various scientifically-vetted techniques can be used to identify &quot;clones&quot; -- a portion of code that is substantially similar to pre-existing source code. The specific area of academic research is called &quot;code cloning detection&quot; or &quot;code duplication detection&quot;. The area has been under active research since the mid-1990s <a href="#fn1" class="footnoteRef" id="fnref1"><sup>1</sup></a>. In 2002, Japanese researchers published a tool called CCFinder <a href="#fn2" class="footnoteRef" id="fnref2"><sup>2</sup></a>, which, in its updated incarnation (called CCFinderX), is widely used and referenced by academic researchers in the field <a href="#fn3" class="footnoteRef" id="fnref3"><sup>3</sup></a> and has specifically been used to explore reuses of code in GPL'd software such as Linux <a href="#fn4" class="footnoteRef" id="fnref4"><sup>4</sup></a>.</p>

<p>CCFinderX uses a token-based clone detection method and a suffix-tree matching algorithm; both techniques have been highly vetted and considered in the academic literature. The techniques are considered viable and useful in detecting clones. Many academic papers on the subject have been peer-reviewed and published, and nearly every newly published paper compares its new techniques of clone detection to the seminal results found by CCFinderX. For purposes of our analysis, we have therefore chosen to use CCFinderX. These results can be easily reproduced since CCFinderX is, itself, also Open Source software.</p>

<h1 id="establishing-a-baseline-of-the-ccfinderx-tool">Establishing A Baseline of the CCFinderX Tool</h1>

<p>CCFinderX offers many statistics for clone detection. After expert analysis, we concluded that most relevant to this situation is the &quot;ratio of similarity&quot; between the existing code and the new code. To establish a baseline, we considered two different comparisons of Free and Open Source Software (FOSS). First, we compared the Linux kernel, Version 4.5.2, to the FreeBSD kernel, Version 10.3.0. This comparison was inspired by the similar 2002 study <a href="#fn5" class="footnoteRef" id="fnref5"><sup>5</sup></a> of these two large C programs. The hypothesis remained that CCFinderX would encounter a low but significant percentage of code similarity, since the FreeBSD and Linux projects collaborate on some subprojects and willingly share code under the 3-Clause BSD license for those parts. (These collaborations are public and well-documented.)</p>

<p>The experiment confirmed the hypothesis. We found that a 3.68% &quot;ratio of similarity&quot; when comparing code from Linux to the FreeBSD kernel.</p>

<p>Next, we compared the source code of the Linux Kernel 4.5.2 to the LLVM+Clang system, version 3.8.0. These two projects are each a large program that are not known to actively share code. There may be some very minimal similarity simply due to chance, but something much lower than the 3.68% found between Linux and FreeBSD's kernel.</p>

<p>Indeed, when the same test is run to compare Linux to the LLVM+Clang system, the &quot;ratio of similarity&quot; was 0.075%.</p>

<h1 id="general-comparison-of-linux-kernel-to-vmware-sources">General Comparison of Linux Kernel to VMware sources</h1>

<p>With the baseline established, we now begin relevant comparisons. First, we compare the Linux kernel version 2.6.34 to the sources <a href="https://k.sfconservancy.org/vmkdrivers">released by VMware in their (partial) source release</a>. The &quot;ratio of similarity&quot; between Linux 2.6.34 and VMware's partial source release is 20.72%. There is little question that much of VMware's kernel has come from Linux.</p>

<h1 id="methodology-of-showing-hellwigs-contributions-in-vmware-esxi-5.5-sources">Methodology Of Showing Hellwig's Contributions in VMware ESXi 5.5 Sources</h1>

<p>The following describes a methodology to show Hellwig's contributions to Linux, and how they compare to code found in VMware ESXi 5.5.</p>

<h2 id="extracting-hellwigs-contributions-from-linux-historical-repository">Extracting Hellwig's Contributions From Linux Historical Repository</h2>

<p>Excellent records exist of contributions made to Linux from 2002-02-04 through present date. From 2002-02-04 through 2005-04-03, Bitkeeper was used to store revision control history of Linux. Each improvement contributed to Linux has information regarding who placed the contribution in Linux, and a comment field in which the contributor can credit others, such as by noting that the contribution actually came from someone else.</p>

<p>I extracted from the historical Linux tree the identifying number of all commits that are either made with Hellwig in the official Author field, or where the person in the Author field left notes clearly indicating that the contribution was done by Hellwig. For the latter, the following regular expression search against the log file was used:</p>

<pre><code>(Submitted\s+by|original\s+patch|patch\s+(from|by)|originally\s+(from|by)).*Hellwig</code></pre>

<p>Specifically, I used <a href="https://github.com/conservancy/gpl-compliance-tools/blob/master/commit-id-list-matching-regex.plx">a script</a> to extract a list of commit ids from the <a href="git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git">historical Linux repository</a>. This method found 1,012 separate occasions of contribution by Hellwig from 2002-02-04 through 2005-04-03.</p>

<p>After finding these separate occasions of contribution, I then extracted the source code lines that Hellwig added or changed in each contribution in this repository. I did so by carefully cross-referencing the commits that Hellwig performed with the output of <code>git blame</code>. I specifically <a href="https://github.com/conservancy/gpl-compliance-tools/blob/master/extract-code-added-in-commits.plx">wrote a script</a> to carefully extracted only lines that Hellwig changed or added in that repository, and placed only those contributions identifiable as Hellwig's into new files whose named matched the original filenames. This created a corpus of code that can be verifiable as added or changed by Hellwig and no one else.</p>

<p>Here are the specific commands I ran:</p>

<pre><code>$ git clone git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git linux-historical

$ ./commit-id-list-matching-regex.plx `pwd`/linux-historical/.git Hellwig '(Submitted\s+by|originals+patch|patch\s+from|originally\s+by).*' > hellwig-historical.ids

$ ./extract-code-added-in-commits.plx --repository=`pwd`/linux-historical --output-dir=`pwd`/hellwig-historical --central-commit e7e173af42dbf37b1d946f9ee00219cb3b2bea6a --progress --blame-opts=-M --blame-opts=-C < ./hellwig-historical.ids

$ git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git linux-current

$ ./commit-id-list-matching-regex.plx `pwd`/linux-current/.git Hellwig '(Submitted\s+by|original\s+patch|patch\s+(from|by)|originally\s+(from|by)).*' > ./hellwig-current.ids

$ ./extract-code-added-in-commits.plx --progress --repository=`pwd`/linux-current --output-dir=`pwd`/hellwig-through-2.6.34 --fork-limit=14 --blame-opts=-M  --blame-opts=-M --blame-opts=-C --blame-opts=-C --central-commit e40152ee1e1c7a63f4777791863215e3faa37a86   &lt; hellwig-current.ids </code></pre>

<p>Note: e40152ee1e1c7a63f4777791863215e3faa37a86 is the 2.6.34 version created by Linus Torvalds <script type="text/javascript">

<!--

h='linux-foundation.org';a='@';n='torvalds';e=n+a+h;

document.write('<a h'+'ref'+'="ma'+'ilto'+':'+e+'">'+e+'<\/'+'a'+'>');

// -->

</script><noscript>&#116;&#x6f;&#114;&#118;&#x61;&#108;&#100;&#x73;&#32;&#x61;&#116;&#32;&#108;&#x69;&#110;&#x75;&#120;&#x2d;&#102;&#x6f;&#x75;&#110;&#100;&#x61;&#116;&#x69;&#x6f;&#110;&#32;&#100;&#x6f;&#116;&#32;&#x6f;&#114;&#x67;</noscript> on 2010-05-16 14:17:36 -0700, with Git commit comment: &quot;Linus 2.6.34&quot;.</p>

<h2 id="comparing-hellwigs-contributions-from-linux-historical-repository-to-vmware-sources">Comparing Hellwig's Contributions From Linux Historical Repository to VMware Sources</h2>

<p>I then used this corpus as input to CCFinderX (similar to the other CCFinderX comparisons explained earlier). Specifically, this CCFinderX comparison compared all known Hellwig-contributed material from the historical Linux repository to the partial VMware source release. CCFinderX found a ratio of similarity of 0.0900% between Hellwig's code and the source code in VMware's (partial) source release. CCFinderX specifically identified 12 distinct locations where substantial sections of code contributed by Hellwig appeared in VMware's code.</p>

<p>Most notably, substantial portions of the the following core SCSI functions were found by this search technique: <code>__scsi_device_lookup</code> and <code>__scsi_get_command</code>, <code>mpt_get_product_name</code>, <code>scsi_proc_host_rm</code>, <code>mega_enum_raid_scsi</code>, <code>mega_m_to_n</code>, <code>mega_prepare_passthru</code>, <code>proc_scsi_show</code>, and <code>__down_read_trylock</code>.</p>

<h2 id="extracting-hellwigs-contributions-from-modern-linux-repository">Extracting Hellwig's Contributions From Modern Linux Repository</h2>

<p>Beginning on 2005-04-16, Linux began using the new Git system to store revision history. This history can be analyzed in a similar fashion as was done for the historical repository.</p>

<p>In this case, I picked a specific revision to center the analysis, the Linux 2.6.34 release from 2010-05-16. For the period from 2005-04-16 through 2010-05-16, I extracted from the modern Linux tree the identifying number of all commits that are either made with Hellwig in the official Author field, or where the person in the Author field left notes clearly indicating that the contribution was done by Hellwig. For the latter, the following regular expression search against the log file was used (as before):</p>

<pre><code>(Submitted\s+by|original\s+patch|patch\s+(from|by)|originally\s+(from|by)).*Hellwig</code></pre>

<p>Specifically, I used the <a href="https://github.com/conservancy/gpl-compliance-tools/blob/master/commit-id-list-matching-regex.plx">same script as before</a> to now extract a list of commit ids from the <a href="git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git">modern Linux repository</a>. This method found 2,595 separate occasions of contribution by Hellwig from 2005-04-16 through 2010-05-16.</p>

<p>As before, after finding these separate occasions of contribution, I then extracted the source code lines that Hellwig added or changed in each contribution in this repository. I did so by carefully cross-referencing the commits that Hellwig performed with the output of <code>git blame</code>. I specifically <a href="https://github.com/conservancy/gpl-compliance-tools/blob/master/extract-code-added-in-commits.plx">used the same script as before</a> to carefully extracted only lines that Hellwig changed or added in that repository, and placed only those contributions identifiable as Hellwig's into new files whose named matched the original filenames. This created a corpus of code that can be verifiable as added or changed by Hellwig and no one else.</p>

<h2 id="comparing-hellwigs-contributions-from-modern-linux-repository-to-vmware-sources">Comparing Hellwig's Contributions From Modern Linux Repository to VMware Sources</h2>

<p>I then used this corpus as input to CCFinderX again. Specifically, this CCFinderX comparison compared all known Hellwig-contributed material from the modern Linux repository to the partial VMware source release. CCFinderX found a ratio of similarity of 0.1615% between Hellwig's code and the source code in VMware's (partial) source release was contributed by Hellwig. CCFinderX specifically identified 23 distinct locations where substantial sections of code contributed by Hellwig appeared. These 23 locations are found in the following 19 functions: <code>mptsas_init</code>, <code>mptsas_get_linkerrors</code>, <code>megasas_build_and_issue_cmd</code>, <code>cciss_getgeo</code>, <code>mptsas_get_bay_identifier</code>, <code>phy_to_ioc</code>, <code>mptsas_sas_enclosure_pg0</code>, <code>SendIocInit</code>, <code>mptsas_parse_device_info</code>, <code>csmisas_sas_device_pg0</code>, <code>mptsas_sas_io_unit_pg0</code>, <code>mptsas_sas_io_unit_pg1</code>, <code>mptsas_sas_expander_pg1</code>, <code>mptsas_sas_enclosure_pg0</code>, <code>aac_handle_aif</code>, <code>mptsas_get_bay_identifier</code>, <code>mpt_host_page_alloc</code>, <code>mptsas_probe_one_phy</code>.</p>

<h2 id="changed-and-added-lines-create-an-incomplete-picture">Changed And Added Lines Create an Incomplete Picture</h2>

<p>In <a href="https://www.linuxfoundation.org/sites/main/files/publications/estimatinglinux.html"><em>Estimating the Total Cost of a Linux Distribution</em></a>, McPherson, Proffitt, and Hale-Evans write:</p>

<blockquote>

<p>Anyone who is familiar with kernel development, for instance, realizes that the highest man-power cost in its development is when code is deleted and modified. The amount of effort that goes into deleting and changing code, not just adding to it, is not reflected in the values associated with this estimate. Because in a collaborative development model, code is developed and then changed and deleted, the true value is far greater than the existing code base. Just think about the process: when a few lines of code are added to the kernel, for instance, many more have to be modified to be compatible with that change. The work that goes into understanding the dependencies and outcomes and then changing that code is not well represented in this study.</p>

</blockquote>

<p>Therefore, the process described herein, which ignores lines that are <em>deleted</em> (thus streamlining and improving code), also ignores a fundamental tenant of software development. Namely, making code smaller, more expressive, and more concise yields better-designed and more easily maintainable software. While the process herein <em>can</em> produce a clear list of code whose known introduction is directly attributable to Hellwig, the analysis produced by this process does not do justice to the full weight of the contributions made by Hellwig, since removed code is outright ignored in this process.</p>

<p>However, we can consider this process above to have found a bare minimum of Hellwig's contributions that appear in VMware's partial source release.</p>

<h1 id="further-analysis-of-additional-examples">Further Analysis of Additional Examples</h1>

<p>Separately from the analysis above, Hellwig identified a specific list of eight critical C functions to which he specifically recalls contributing, and near-equivalents were found in VMware's ESXi 5.5 product.</p>

<p>In this additional analysis, we used CCFinderX in a different way <a href="#fn6" class="footnoteRef" id="fnref6"><sup>6</sup></a>. In these tests, I confine the code tests to specific small sections of code that were previously identified by human analysis as similar. In this way, I used CCFinderX to confirm with computational analysis what was already obvious to the human eye.</p>

<p>As expected, the ratio of similarity between the Hellwig's implementation and the corresponding implementation found in VMware's ESXi 5.5 product are quite high. As show in the table below, these particular functions show a incredibly high degree of similarity.</p>

<table>

<thead>

<tr class="header">

<th style="text-align: left;">Function</th>

<th style="text-align: center;">Ratio of Similarity</th>

</tr>

</thead>

<tbody>

<tr class="odd">

<td style="text-align: left;"><code>scsi_destroy_command_freelist</code></td>

<td style="text-align: center;">82.9545%</td>

</tr>

<tr class="even">

<td style="text-align: left;"><code>__scsi_device_lookup</code></td>

<td style="text-align: center;">98.4375%</td>

</tr>

<tr class="odd">

<td style="text-align: left;"><code>scsi_device_lookup</code></td>

<td style="text-align: center;">58.4785%</td>

</tr>

<tr class="even">

<td style="text-align: left;"><code>__scsi_get_command</code></td>

<td style="text-align: center;">69.2308%</td>

</tr>

<tr class="odd">

<td style="text-align: left;"><code>__scsi_iterate_devices</code></td>

<td style="text-align: center;">47.6190%</td>

</tr>

<tr class="even">

<td style="text-align: left;"><code>scsi_put_command</code></td>

<td style="text-align: center;">49.0347%</td>

</tr>

<tr class="odd">

<td style="text-align: left;"><code>scsi_remove_single_device</code></td>

<td style="text-align: center;">99.0566%</td>

</tr>

<tr class="even">

<td style="text-align: left;"><code>scsi_setup_command_freelist</code></td>

{% extends "base_compliance.html" %}

{% block subtitle %}Copyleft Compliance Projects - {% endblock %}

{% block content %}

<h2>The time has come to stand up for the GPL.</h2>

<p><strong>Update 2019-04-02:</strong> Please

  see <a href="https://sfconservancy.org/news/2019/apr/02/vmware-no-appeal/">this

  announcement regarding conclusion of the VMware suit in Germany</a>.  Since the suit has

  concluded, any funds you donate here will support our ongoing compliance efforts.  The

  remaining material below is left as it was before that announcement:</p>

<p><em>In March 2015, Conservancy <a href="/news/2015/mar/05/vmware-lawsuit/">announced Christoph Hellwig's

    lawsuit against VMware in Germany</a>.  In July 2016,

    we <a href="/news/2016/aug/09/vmware-appeal/">announced that Christoph

    would appeal the lower court's ruling</a>.</p>

    Support Conservancy's and Christoph's efforts in this area

    by <a href="/sustainer/">becoming a Conservancy

    sustainer</a> or <a href="#donate-box" class="donate-now">donating via

    the link on the right</a>.</em></p>

<p>We were told to ask nicely and repeatedly, so we did.</p>

<p>We asked allies to help us make contact in friendly and professional

  ways.</p>

<p>Everyone asked us to give companies as many chances as possible and as

  much help as possible to comply with copyleft, so we did.</p>

<p>We've worked for years to help VMware comply with the GPL, but they

refuse. Negotiations broke down for the last time when they insisted on an 

NDA just to discuss settlement terms!</p>

<p>Christoph is among the most active developers of Linux.  As of Feburary 

19, 2015, Christoph has contributed 279,653 lines of code to the Linux kernel, 

and ranks 20th among the 1,340 developers involved in the latest 3.19 kernel 

release.  Christoph also

ranks 4th among those who have reviewed third-party source code, tirelessly

corrected and commented on other developers' contributions.  Christoph

licenses his code to the public under the terms of the GPL for practical and

ideological reasons.  VMware, a company with net revenue of over $1 billion

and over 14,000 employees, ignored Christoph's choice.  They took Christoph's

code from Linux and modified it to work with their own kernel without releasing

source code of the resulting complete work.  This is precisely the kind of

activity Christoph and other kernel developers seek to prevent by choosing

the GPL.  The GPL was written to prevent this specific scenario!</p>

<h3>This is a matter of principle.</h3>

<p>Free and open source software is everywhere and in everything; yet our

  software freedom is constantly eroded.</p>

<p>We want companies to incorporate our software into new products, but there

are a few simple rules.  Copylefted free software is so prevalent because

there's no way a company can compete without using a significant amount of

free software to bring products to market in reasonable time. They get so

much benefit from our work.  Allowing the whole community to review, use,

improve and work with the code seems very little to ask in return.  Copyleft

also ensures competitors cannot undercut those who contribute.  Without active enforcement, the GPL is

effectively no different from a non-copyleft license.</p>

<p>What point is there for companies to make sure that they're compliant if

there are no consequences when the GPL is violated? Many will continue to

ignore the rules without enforcement.  We know that there are so many

companies that willingly comply and embrace GPL as part of their business.

Some are temporarily out of compliance and need to be brought up to speed,

but willingly comply once they realize there is an issue.  Sadly, VMware sits

in the rare but infamous class of perpetually non-compliant companies. VMware

has been aware of their noncompliance for years but actively refuses to do

the right thing.  Help us do right by those who take the code in the spirit

it was given and comply with copyleft, and stop those don't.</p>

<p>We know that copyleft isn't a favorite licensing strategy for some in our

community.  Even so, this case will help bring clarity on the question of

combined and derivative works, and is essential to the future of all software

freedom.  This case deserves support from copyleft and non-copyleft free

software communities alike.</p>

<h3>Show you care</h3>

<p>Bad actors have become complacent because they think you don't care.  A

  strong show of public support for Conservancy and Christoph's position will

  help our legal case and demonstrate the interpretive context for it.

  Please <a href="#donate-box" class="donate-now">donate</a> to our campaign to enforce the GPL.  Help Conservancy

  increase its number of individual donors, so we have clear evidence to show

  bad actors that the GPL matters to the individuals in our community.

  After you <a href="#donate-box" class="donate-now">donate</a>, go and tell the world: &ldquo;Play by the rules, @VMware. I defend the #GPL with Christoph &amp; @Conservancy. #DTRTvmware  Help at https://sfconservancy.org/sustainer/ &rdquo; on your blog or microblog.

  </p>

<h3>Isn't the combined works and/or derivative works question a legal grey area?</h3>

<p>We don't think so, but this case will let the court to decide that question.

Either way, it's beneficial to our entire community to find out what the

judges think.  (Check out our <a href="/copyleft-compliance/vmware-lawsuit-faq.html">FAQ to find out more

information</a>.)</p>

<p>Help us pay for this expensive lawsuit and to generally defend software

{% extends "base_compliance.html" %}

{% block subtitle %}Copyleft Compliance Projects - {% endblock %}

{% block content %}

<h1>Frequently Asked Questions about Christoph Hellwig's VMware Lawsuit</h1>

<p><strong>Update 2019-04-02:</strong> Please

  see <a href="https://sfconservancy.org/news/2019/apr/02/vmware-no-appeal/">this

  announcement regarding conclusion of the VMware suit in Germany</a>.  Since the suit has

  concluded, any funds you donate here will support our ongoing compliance efforts.  The

  remaining material below is left as it was before that announcement:</p>

<p>Conservancy maintains this

  <abbr title="Frequently Asked Questions">FAQ</abbr> list regarding

  <a href="/news/2015/mar/05/vmware-lawsuit/">Christoph Hellwig's lawsuit against VMware

  in Germany over alleged GPL violations on Linux</a> as a service to the

  Free Software community, and in particular, the copyleft community.  Conservancy

  realizes this lawsuit generates many questions and interest

  from the community.  Legal counsel (both Conservancy's own, and

  Christoph's lawyer, Till Jaeger) correctly advise us to limit our public

  comments regarding specific details of the case while litigation remains

  pending in court.  Nevertheless, Conservancy, as a

  non-profit charity serving the public good, seeks to be as transparent as

  possible.  If you have additional questions you'd like to see answered

  here, please <a href="mailto:info@sfconservancy.org">email

  &lt;info@sfconservancy.org&gt;</a>, but understand that we may often need

  to answer: <q>We cannot comment on this while litigation is pending</q>.</p>

<details>

  <summary>Who is the Plaintiff in the lawsuit?</summary>

  <p>Christoph is one of most active developers of the Linux kernel. He has

   contributed 279,653 lines of code to the latest Linux 3.19 kernel, and

   thus ranks 20th among the 1,340 developers involved in that release.

   Christoph also ranks 4th among those who have reviewed third-party source

   code, and he has tirelessly corrected and commented on other developers'

   contributions.</p>

</details>

</details>

<details>

  <summary id="court-documents">Are the court documents released?</summary>

  <p>Not currently.  Court proceedings are not public by default in Germanyg (unlike in the USA).  Conservancy will continue to update this FAQ with

  information that Conservancy knows about the case.  We would all also

  welcome an agreement with VMware whereby both sides would agree to publish

  all Court documents.  Unfortunately, VMware has explicitly asked for the

  filings not to be published.   Accordingly, Conservancy itself has not

  even been able to review VMware's statement of defense nor Christoph's

  response to that statement of defense.</p>

</details>

<details>

  <summary id="funding">Who's funding this lawsuit?</summary>

  <p>Conservancy has engaged in a grant agreement with Christoph Hellwig for

  the purposes of pursuing this specific legal action in Germany.

  Conservancy is funding this legal action specifically as part of

  Conservancy's program activity in

  its <a href="/copyleft-compliance/about.html">GPL Compliance

  Project for Linux Developers</a>.</p>

</details>

<details>

  <summary id="combined-and-derivative-works">Is this the Great Test Case of Combined / Derivative Works?</summary>

  <p>This case is specifically regarding a combined work that VMware

  allegedly created by combining their own code (“vmkernel”) with

  portions of Linux's code, which was licensed only under GPLv2.  As such,

  this, to our knowledge, marks the first time an enforcement case is

  exclusively focused on this type of legal question relating to GPL.

  However, there are so many different ways to make combined and/or

  derivative works that are covered by GPL that no single case could possibly

  include all such issues. </p>

</details>

<details>

  <summary id="why-lawsuit">Why must you file a lawsuit?  Isn't there any other way to convince VMware to comply with GPL?</summary>

  <p>Neither Conservancy nor Christoph takes this action lightly nor without

  exhausting every other possible alternative first.  This lawsuit is the

    outgrowth of years of effort to convince VMware to comply with GPL.</p>

    <p>In October 2011, Conservancy received a GPL violation report on

  BusyBox for VMware's ESXi products.  Conservancy opened the matter in its

  usual, friendly, and non-confrontational way.  Nevertheless, VMware

  immediately referred Conservancy to VMware's outside legal counsel in the

  USA, and Conservancy negotiated with VMware's legal counsel throughout

  late 2011, 2012 and 2013.  We exchanged and reviewed

  <a title="Complete, Corresponding Source" href="https://copyleft.org/guide/comprehensive-gpl-guidech6.html#x9-470005.2.1">CCS</a> candidates, and

  admittedly, VMware made substantial and good efforts toward compliance on

  BusyBox.  However, VMware still refused to fix a few minor and one major

  compliance problem that we discovered during the process.  Namely, there

  was a major violation regarding Linux itself that ultimately became

  Christoph's key complaint in this lawsuit.</p>

 <p>Meanwhile, when Conservancy realized in late 2012 there might be a major

  display: block !important;

  position: relative !important;

  top: auto !important;

  left: 0 !important;

  right: auto !important;

  text-align: left !important;

}

#navbar.mobile > ul > li {

  padding-top: .5rem;

  padding-bottom: .5rem;

}

#navbar.mobile > ul > li {

  border-bottom: 1px solid rgba(255, 255, 255, 0.2);

}

#navbar.mobile li ul {

  margin-left: .5rem;

}

#progressbar {

    height: 1.8em;

}

#progressbar .ui-widget-header {

    background: rgb(206, 31, 31);

}

#siteprogressbar .goalText {

    color: #557733;

    font-size: 10pt;

}

#siteprogressbar .soFarText {

    font-size: 10pt;

}

#siteprogressbar .progress {

    background: #577632;

}

@media all and (max-width: 600px) {

  .goalText {

      font-size: 8pt;

  }

  .soFarText {

      font-size: 8pt;

  }

}

#siteprogressbar .progress {

    background: #577632;

}

#siteprogressbar .middle-goal {

    background: #d0d0d0;

}

#siteprogressbar .final-goal {

    background: #eeeeee;

}

#fundraiser-percentage {

    text-align: center;

}

#container #mainContent {

    max-width: 50em;

    margin: 0;

    padding: 0;

    background: #ffffff;

    flex: 1 1 auto;

}

#container #sidebar {

  background-color: #e6eae1;

  padding: 1px 0.5rem 0.25rem;

  margin-bottom: 1rem;

}

@media screen and (min-width: 30em) {

  #container {

    display: flex;

  }

  #container #sidebar {

  flex: 1 0 15em;

    margin-right: 1rem;

  }

}

#container #sidebar li {

    text-align: center;

    list-style: none;

    padding: 3px 10px 3px 10px;

    margin: 5px;

    border: 1px solid #CCC;

    background: #eaf1f1;

    background: -moz-linear-gradient(top, #fff, #eaf1f1);

    background: -webkit-linear-gradient(top, #fff, #eaf1f1);

    background: linear-gradient(to bottom, #fff, #eaf1f1);

    filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff', endColorstr='#eaf1f1', GradientType=0);

}

#container #sidebar li a:hover { background: #577632; color: #fff; }

#container #sidebar.Directors ul li.Directors,

#container #sidebar.Eval ul li.Eval,

#container #sidebar.Overview ul li.Overview,

#container #sidebar.Contact ul li.Contact,

#container #sidebar.Staff ul li.Staff,

#container #sidebar.Outside ul li.Outside,

#container #sidebar.Transparency ul li.Transparency,

#container #sidebar.License ul li.License,

#container #sidebar.Current ul li.Current,

#container #sidebar.Services ul li.Services,

#container #sidebar.Applying ul li.Applying,

#container #sidebar.VizioPressRelease ul li.VizioPressRelase,

#container #sidebar.VizioPressKit ul li.VizioPressKit,

#container #sidebar.VizioPhotoAssets ul li.VizioPhotoAssets,

#container #sidebar.Glossary ul li.Glossary,

#container #sidebar.HelpComply ul li.HelpComply,

#container #sidebar.EnforcementStrategy ul li.EnforcementStrategy,

{

    color: #000033;

    font-weight: bold;

    background: #e3e6e0;

}

#container #sidebar h2 {

    text-align: center;

    font-size: 1.25em;

    margin: 1.5em 0 0.8em 0;

}

#container #sidebar hr {

    width: 75%;

    float: center;

    clear: all;

}

.shaded { background: #F0FFB8; padding: .1em .5em; margin-bottom: .5em; }

.columns {

}

.column h2 { font-size: 1.25em; }

.column h3 { font-size: 1.1em; }

.column hr { width: 50%; margin-left: auto; margin-right: auto; }

.column h2 a { text-decoration: none; color: #000000; }

.column h2 a:hover { text-decoration: underline; }

#conservancyfooter {

  border-top: 1px solid #ccc;

  text-align: center;

  overflow: auto;

}

.continued {

  display: block;

  font-size: .9em;

  font-weight: bold;

  margin-top: 1em;

  margin-bottom: 1em;

}

.date, .blog-tags, .blog-comments {

  font-style: italic;

  font-size: .9em;

  margin-bottom: .3em;

  margin-top: .3em;

}

a.feedlink /* RSS icon */ { display: block; float: right; font-size: 10pt; }

blockquote, div.quote /* div.quote is used by conservancy whitepaper */ {

  margin-left: 2em;

  margin-right: 2em;

  padding-left: 1em;

  padding-right: 1em;

  border: 1px solid #fff;

  background: #eee;

}

.newsgraphic { float: right; }

.newsgraphic img { border: 1px solid #000; }

.picture {

    text-align: center;

    font-style: italic;

}

.picture img {

    margin: 0 auto;

    max-width: 100%;

}

.picture-small {

    padding-left: 1em;

    border: thin silver solid;

    padding: 0.5em;

    text-align: center;

    font-style: italic;

    font-size: 70%;

    text-indent: 0;

    margin: .25em;

    min-width: 8%;

    width: auto;

    box-shadow: 1px 1px 2px rgba(0,0,0,.3);

    margin-bottom: 1rem;

}

@media screen and (min-width: 30em) {

  .picture-small {

    max-width: 20rem;

  }

}

.picture-small img {

   width: 100%;

}

.picture-tiny {

    padding-left: 1em;

    border: thin silver solid;

    padding: 0.5em;

    text-align: center;

    font-style: italic;

    font-size: 50%;

    text-indent: 0;

    margin: .25em;

    min-width: 4%;

    max-width: 15%;

    width: auto;

}

.picture-tiny img {

   width: 100%;

}

.secondary_info { font-size: 83%; }

.next_page_button { float: right; }

.pagination_list { text-align: center; }

.document_format { border: 1px solid #888; padding: .2em; background: #fff99d;}

.copyright_info { font-size: 90%; }

hr.footnote-separator { width: 80%; margin-left: auto; margin-right: auto; }

.doc-footer { font-style: italic; }

.doc-footer > *:first-child::before { content: "["; }

.doc-footer > *:last-child::after   { content: "]"; }