@Thomas Would that not mean you could be hit legally even if you would have agreements with Cloanto and/or Hyperion?
Yes, such a risk exists, in principle. It all depends on whether Amiga Inc was ever in posession of the copyrights (likely, but not necessarily), and even then, a permission from Hyperion might mean nothing if Cloanto is the owner on 3.1 (it does not seem so, but who knows?), and a permission from Cloanto means nothing if Hyperion is the owner (which is currently my most plausible assumption, but who knows?). Then we have components that were developed under contract of H&P, which means that H&P may have some rights, and components developed for H&P under 3.9 for which the rights may or may not have went back to the individuals that contributed.
So, at this point, I'm completely unclear where the rights for FFS or SetPatch are located. The headers say "(c) Heinz Wrobel". It was done for 3.9, so is it "(c) H&P"? Or did Heinz regain rights on them after a two years period? Or did Hyperion bought the rights for that from H&P? It all depends on the individual contracts that had been negotiated between parties back then, and into which I do not have any insight.
So yes, it is complicated.
That would mean that Aros Rom Replacements are the only legal safe way to use?
No, certainly not. If you bought your system with 3.1, you can use those ROMs without any danger. If you bought the 3.1 ROMs back then in a shop, copyright was fairly clear, and there is no danger either.
If you buy a 3.1 ROM from Cloanto these days... well, who knows? If you buy a 3.1 ROM from Hyperion these days... well, who knows?
It is highly unlikely that any of these players will reach out to individuals as there is no money to be made, so no worries. But if you *distribute* masses of such ROMs, you may become a problem. That is, either stand alone, or as part of another product, you may be in trouble - potentially.
So, for example, the vampire depends on 3.1 ROMs from Cloanto. Do they have actually rights on this ROM? Honestly, I do not know, but at least their copyright is not registered (which is likely not necessary), but it's at least a bit strange that the copyright for all other Kickstarts *are* registered for Cloanto, and you may wonder why.
I know that you prefer to use 3.1 as base f.e. for Vampire/standalone devices but would your preferred way not be very risky for any commercial vendor?
I would not call it "very risky", especially the "very" part, but at least there is a potential risk given the highly unclear situation.
Then again, has any individual contributing to AROS has ever had a look at the Amiga Os sources? If so, please add the "risk part" here, too. Not the "very" part.