Prusa Breach Their Own GPLv3 License for Over a Week
9 days ago Prusa started distributing Firmware 7.0.0 for their printers, which was followed up by Firmware 8.0.0 two days ago. As of writing, the latest published sources are for Firmware 6.9.2.
Note: I am not a legal expert, just someone that’s interested in, and spent a lot of time looking at, open source licensing.
The License Requirements
The firmware sources are published under a GPLv3 license. As per section 6, “Conveying Non-Source Forms”, the license states:
You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
[…]
d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
In the above I’ve selected the most relevant distribution means for their online sharing of the firmware, but the requirements will be a little different for physical machines distributed with the new firmware.
TL;DR: If you share the built version of the code (firmware), you need to make the sources accessible too.
What Prusa Say
On Reddit, a member of the Prusa team stated:
No. As this update has some security improvements, we want users to have a chance to update first before we release the source code, as technically that could get reverse engineered and exploited from that. It’s nothing crazy critical, but still a precaution
I asked Prusa if they retained (non-GPLv3) license rights to withhold the sources, and if they’re not in breach of their license terms, and the response was as follows:
We MUST (and will) release it on github. I’m not directly involved in this but to my knowledge there’s a window of time to release it. We are currently waiting to make sure a healthy amount of downloads and updates have taken place so that potential vulnerabilities that were fixed could not be reverse engineered and exploited by bad actors.
I asked where the referenced time window is defined, but they did not respond to that question.
A contributor had also queried this via the source repo on GitHub, with no official response from Prusa as of yet.
Is Their Reason Justified?
This will come down to a matter of personal views.
Personally, I don’t think it’s valid to violate the license rights in the name of security. That could lead to a trend of businesses avoiding license requirements with the excuse of security, with the goal of limiting competition.
Additionally, it is questionable if it really helps their users from a security point of view. Especially in this age of LLM tooling, those wanting to attack could reverse engineer the firmware to understand the issues addressed, while users lack sources to understand risk or improve source security themselves. Even in Prusa’s own forums, users are decompiling using Claude to gain a better understanding of firmware changes.
Why Does This Matter?
Some may say Prusa can do what they want with their work, and that’s fair by itself, but the firmware is not only the work of Prusa. As per the benefits of open source, the sources are comprised from the work of many others upon Prusa, who have provided their works under the GPLv3 license terms, and they are now distributing against those terms.
Additionally:
- Users can’t (easily) verify what code is now running on their machines.
- Users can’t build the firmware from source themselves to ensure their firmware is from sources.
- Users can’t apply modifications and fixes, or address new firmware bugs as a community.
- Users who rely on modified firmware can’t apply their modifications to new firmware, and are therefore being left out of the Prusa referenced security fixes in these new releases.
Prusa users pay a premium for their machines, and many accept that as the price of supporting a business that respects, and is, open source. But the company seems to lack the actual respect to open source that their marketing shouts about.
Take this “Open-source at Prusa Research” page as an example. In respect of the established definitions of open source and open source hardware, many of the claims would be misleading to many. As above, current versions of the firmware are not open source. Their CAD assemblies are provided under their own misleadingly named “Open Community License” which does not meet the above open source definitions due to limits on rights relating to what open source defines. This is a license which they continue to advertise as open source despite much community feedback.
But Other Company X Is Also Doing This!
I don’t doubt that, it’s not uncommon. But Prusa has built a reputation as an open source respecting printer manufacturer. That reputation is used for marketing and to justify their higher prices. If Prusa gets away with this, then that lowers the bar across the industry.