[Gnuk-users] Gnuk 1.2.6 / NeuG 1.0.6 / Chopstx 1.5 / Fraucheky 0.5

[NIIBE Yutaka]

Daniel Kahn Gillmor <dkg at fifthhorseman.net> wrote:
> gniibe, maybe you could comment on this for about firmware blobs shipped
> in debian?  what would be the tradeoffs and decisions to make between
> FSIJ and Debian?

The condition of use of VID of FSIJ is bounded by the agreement between
USB IF and FSIJ.

Basically, FSIJ cannot transfer its use of VID to others.

In case of Flying Stone Technology and FSIJ, it is FSIJ which asked the
realization of the product, and the product distribution (that is, VID
distribution) is considered under full control of FSIJ.  Flying Stone
Technology have to do regular report to FSIJ (how many shipments and
from/to where, how many production in which place, etc.), and any code
written by me for Gnuk is assigned to FSIJ.

The agreement is available (it's not FSIJ specific) from USB.org.

Full version:

    http://www.usb.org/developers/USB-IF_Member_Agreement_030917.pdf

Short version:

    http://www.usb.org/developers/vendor/VID_Only_Form_030917.pdf

The latter says:

    The company set forth above hereby applies for a USB Vendor ID
    Number and agrees to the following:

        The USB Implementers Forum is the authority which assigns and
        maintains all USB Vendor ID Numbers.  Each Vendor ID Number is
        assigned to one com pany for its sole and exclusive use, along
        with associated Product ID Numbers. They may not be sold,
        transferred, or used by others, directly or indirectly, except
        in special circumstances and then only upon prior written
        approval by USB-IF.  Unauthorized use of assigned or unassigned
        USB Vendor ID Numbers and associated Product ID Numbers are
        strictly prohibited.


I think that the condition matters even for distribution of the binary
blobs.  I mean, my interpretation is: even if it's not included within
the hardware device, the distribution of the firmware with VID is bound
to the agreement.  It is only possible under the assignee's full
control.

Perhaps, it would be possible to arrange some specific cases, by asking
USB-IF for prior written approval.

In my opinion (no, I don't get official answer from USB-IF), I don't
think USB-IF allows to distribute the blobs with VID for general purpose
under the semantics of Free Software or DFSG.  Freedom 0 comes with "any
purpose".  I'm afraid this is not compatible to the picture of USB-IF's
control of VID.


In 2012 (the commit ac28ee1), the configure --vidpid option was
introduced, so that the source code distribution of Gnuk can maintain
the condition of keeping agreement between USB-IF and FSIJ.

This year, when I introduced the USB emulation feature, I introduced
runtime option of --vidpid for the Gnuk executable, so that the
executable doesn't include VID:PID (and it is an end user who specifies
VID:PID).  I assume it is OK for an end user to specify any VID:PID.

IIRC, I once distributed some versions of binary of Gnuk at
gitorious.org, for convenience (or so that people can make sure).  But,
I stopped doing that, because I realized that its inclusion of VID:PID
would violate the agreement between FSIJ and USB-IF.


This practice (of avoiding distribution of binary with VID:PID) would be
excessively conservative.  But, my idea is that... I don't want FSIJ to
be accused by USB-IF.  Or, I want to keep the distribution of the
hardware product of Gnuk Token safe.


Another issue of USB ID is that, it is not displayed correctly by
lsusb.  I put here: https://usb-ids.gowdy.us/read/UD/234b


Any suggestions are welcome.

Is it acceptable for users, my preparing of some tool which generates
final binary from binary template?  I mean, we will distribute binary
without VID:PID, and it will be an end user who will put the VID:PID at
the field.
--