Opened 6 months ago

#10643 new license violation

Tablo/Nuvyyo violation of FFmpeg LGPL/GPL licenses

Reported by: chilinux Owned by:
Priority: normal Component: ffmpeg
Version: unspecified Keywords:
Cc: chilinux Blocked By:
Blocking: Reproduced by developer: yes
Analyzed by developer: no

Description

Summary of the bug:
How to reproduce:

Tablo (made by Nuvyyo) is a DVR for the USA for over the air broadcasts. The latest (4th Generation) DVR records the raw ATSC MPEG2 video frames to hard disk. Then for playback it delivers the raw MPEG2 video frames to the video player (there is no transcoding on the 4th Gen DVR).

Android is a supported platform for Tablo but not all versions of Android have native MPEG2 support built-in. To address this, Tablo seems to have included FFmpeg libraries compiled by the Android NDK in their app.

I had contacted their support that they might be violating the Google Play Developer Distribution Agreement clause 11 which states they represent and warrant that they have the right to distribute third-party material in the product. As an example, I brought up FFmpeg being covered by the LGPL.

In response, they eventually added an Open Source disclosures section to the setting part of the Android app. This largely only discloses use of Apache Licensed covered Android libraries. It does not disclose use of FFmpeg.

The Android app can be found here:
https://play.google.com/store/apps/details?id=com.nuvyyo.TabloFAST

The XAPK can be downloaded directly from Google using this Chrome extension:
https://chromewebstore.google.com/detail/apk-downloader/glngapejbnmnicniccdcemghaoaopdji?hl=en-GB

It can be downloaded indirectly from APK Pure from here:
https://apkpure.com/tablo/com.nuvyyo.TabloFAST/download

You can confirm the APK section of the APK Pure XAPK is digitally signed by Google using the Java keytool by doing the following:

mkdir tablo-apkpure-1.0.7
cd tablo-apkpure-1.0.7
unzip ../Tablo_1.0.7_Apkpure.xapk
keytool -printcert -jarfile config.arm64_v8a.apk

Google's certificate fingerprint is:
SHA256: 6E:D2:EC:0B:1C:A2:95:8B:F2:D5:C1:DC:CA:0A:F1:7A:EF:FE:CC:7F:2F:B9:8B:16:9D:86:06:E2:CD:30:D3:A2

Then unzip the config.arm64_v8a.apk
Look in lib/arm64-v8a

The directory contains these files:
libRSSupport.so libavformat.so libleveldbjni.so librsjni.so libyuv-decoder.so
libavcodec.so libavutil.so libmpv.so librsjni_androidx.so
libavdevice.so libc++_shared.so libplayer.so libswresample.so
libavfilter.so libffmpeg.so libpostproc.so libswscale.so

Then run this:
strings -f * | grep "enable-gpl" | cut -d: -f1

Shows the following files are compiled with --enable-gpl:
libavcodec.so
libavdevice.so
libavfilter.so
libavformat.so
libavutil.so
libpostproc.so
libswresample.so
libswscale.so

Again, while Tablo does have an Open Source Disclosure section to their app now, they do not provide a copy of the LGPL or GPL and do not disclose use of FFmpeg.

The contact us page for Tablo is available here:
https://www.tablotv.com/contact/

The Google Play store web page to report license violations is available here:
https://support.google.com/legal/troubleshooter/1114905

Change History (0)

Note: See TracTickets for help on using tickets.