Open Source Compliance Requirements

[andrewhavens]

Hello! I'm working on making sure our project is in compliance with the requirements of the open source licenses used by our project. Our project is a hardware device that runs Arch Linux ARM on the device. We've also made a few modifications/additions (not sure on the details of whether or not it constitutes a derivative). We also make use of other open source packages. As far as I understand, since Arch Linux ARM is a derivative of a GPLv2 project, that means we need to offer to mail a CD of the source code of the version of Arch Linux ARM we are using in addition to our modifications. I'm new to working with GPLv2 projects (and open source compliance in general), so I'm just a little confused by the attribution/distribution requirements. Have any of you had to deal with this before? What do you recommend? Should we make a webpage that lists all of the open source projects that we use? What is required on that webpage? Any thoughts or advice would be appreciated. Thanks!

[schard]

Firstly: IANAL.
Our company operates several digital signage systems running (the original) Arch Linux with additional free and proprietary software of us.
However, our customers don't buy the operating system or software.
They buy the hardware and we install our software on their hardware.
Since we don't sell our software but provide the updating of the digital signage data as a service, we don't run into the problem that we would need to make Arch Linux's source code available (though we could and would if a customer would actually care).
However if you sell the software as an integrated solution bundled with your hardware, the GPL copying and redistribution conditions should apply.
To determine how to handle them should be the task of your company's legal department.