It's not that hard

> FWIW, I used to work for a company that used some GPL and other free software in its
product. We found the easiest way to comply was to simply build the tarballs from our CVS and
include them on the product CD. The customer thus got the version we were using, including any
mods. This, of course, assumes you're not trying to hide the fact that you're using free
software.

My employer does something similar, though we aren't in the end-user business.  Instead, we
actually ship to our customers a full source tree. One of the targets of the build system
takes all of the GPL'd components and emits a nice tarball of the exact source used to build a
binary image.