> However, would it not be a better practice to maintain the FL/OSS parts
in an internal repository as an integral part of the device development
process, tag each firmware release, and simply push
> that to a public (git) repository or produce a tar-ball?
It would be impossible to expect that every change to a FOSS package
(kernel, busybox, whatever else) be vetted to make sure its legally clean
and releasable before it was pushed to the internal tree. (speaking from my
own experience working at a company doing embedded devices, it would have
been impossible to get anything done if your team's part of the software
was FOSS and you had to get every change signed off by
legal/copyright/licensing people before pushing it)
And its not just code that the manufacturer has licensed from a 3rd party
and has to be careful about how they release it. Licenses and NDAs for
hardware chips and such contain rules about how much information the
company using the chip is allowed to disclose. Licenses for software
technology and patents (e.g. proprietary file systems) might contain
restrictions on distributing that information. Regulatory reasons might
make sharing the source code hard. (e.g. restrictions on power and
frequency for various radio standards where opening the source might make
it possible to change those beyond the allowed limits) Carriers and ISPs
might not want the source distributed because it could be used to enable
features those carriers and ISPs dont want on their networks or because
people messing with the software could cause harm to the devices or to the
networks those devices talk to.
Getting all the legal things right to make sure that the source code is in
compliance with the FOSS licenses it is releases under AND with all the
other licenses, NDAs, contracts and agreements the manufacturer may have
signed that pertain to the device (or might pertain to the device) is hard
and takes time.
