On Fri, Oct 17, 2025 at 10:57:41AM +0200, Holger Assmann wrote: > With the release of IMX-CST v4+ as only IMX_CST_TOOL_NEW variant, NXP no > longer provides any official download link for v3.4.1. > > Switching to the latest release would require a lot of integration work > due to significant changes in the code base while not providing any > advantages for the platforms currently using v3.4.1. > > We hence keep the former version for now and switch over to Debian > snapshot as source. This comes with the additional benefit of the > package now being aligned with the Debian Free Software Guidelines > (DFSG), which removes the need for accepting an EULA at the get stage. > > Signed-off-by: Holger Assmann <[email protected]> > --- > rules/host-imx-cst.make | 30 +++++------------------------- > 1 file changed, 5 insertions(+), 25 deletions(-) > > diff --git a/rules/host-imx-cst.make b/rules/host-imx-cst.make > index 68069aaa5..1d3f42c64 100644 > --- a/rules/host-imx-cst.make > +++ b/rules/host-imx-cst.make > @@ -15,34 +15,14 @@ HOST_PACKAGES-$(PTXCONF_HOST_IMX_CST) += host-imx-cst > # Paths and names > # > HOST_IMX_CST_VERSION := 3.4.1 > -HOST_IMX_CST_MD5 := b23ed5983734d4812fcf1da33eac8f31 > +HOST_IMX_CST_MD5 := 72aeb8e0394c3117c5a19da0e7e4fa84 > HOST_IMX_CST := cst-$(HOST_IMX_CST_VERSION) > -HOST_IMX_CST_SUFFIX := tgz > -HOST_IMX_CST_URL := > https://www.nxp.com/webapp/sps/download/license.jsp?colCode=IMX_CST_TOOL_NEW > +HOST_IMX_CST_MOD := +dfsg.orig > +HOST_IMX_CST_SUFFIX := tar.xz > +HOST_IMX_CST_URL := > https://snapshot.debian.org/archive/debian/20251014T030053Z/pool/main/i/imx-code-signing-tool/imx-code-signing-tool_$(HOST_IMX_CST_VERSION)$(HOST_IMX_CST_MOD).$(HOST_IMX_CST_SUFFIX) > HOST_IMX_CST_SOURCE := $(SRCDIR)/$(HOST_IMX_CST).$(HOST_IMX_CST_SUFFIX) > HOST_IMX_CST_DIR := $(HOST_BUILDDIR)/$(HOST_IMX_CST) > -HOST_IMX_CST_LICENSE := proprietary > - > -# > ---------------------------------------------------------------------------- > -# Get > -# > ---------------------------------------------------------------------------- > - > -$(HOST_IMX_CST_SOURCE): > - @$(call targetinfo) > - @echo > "************************************************************************" > - @echo "*" > - @echo "* Due to license restrictions please download version > $(HOST_IMX_CST_VERSION) manually from:" > - @echo "*" > - @echo "* $(HOST_IMX_CST_URL)" > - @echo "*" > - @echo "* and place it into the source directory as:" > - @echo "*" > - @echo "* $(HOST_IMX_CST_SOURCE)" > - @echo "*" > - @echo "*" > - @echo > "************************************************************************" > - @echo > - @exit 1 > +HOST_IMX_CST_LICENSE := BSD-3-Clause AND BSD-2-Clause AND OpenSSL
Software_Content_Register_CST.txt mentions the three LICENSE.* files: * LICENSE.openssl includes OpenSSL or Apache-2.0 licenses (depending on which version of OpenSSL is used) because it links to OpenSSL statically * LICENSE.bsd3 is the BSD-3-Clause, this is also the only one whose references can be found with a `grep -R SPDX-License` over the code base. * LICENSE.hidapi is something else unknown to SPDX. So: HOST_IMX_CST_LICENSE := BSD-3-Clause AND (OpenSSL OR Apache-2.0) AND custom HOST_IMX_CST_LICENSE_FILES := \ file://Software_Content_Register_CST.txt;startline=5;endline=8;md5=58eeb2145e365237c49d5e91f6b10f7d \ file://code/front_end/src/cst.c;startline=1;endline=5;md5=d3dc6d769e75ac1dd16b77d9ab467521 \ file://LICENSE.bsd3;md5=14aba05f9fa6c25527297c8aac95fcf6 \ file://LICENSE.openssl;md5=3441526b1df5cc01d812c7dfc218cea6 \ file://LICENSE.hidapi;md5=e0ea014f523f64f0adb13409055ee59e - Roland > > # > ---------------------------------------------------------------------------- > # Prepare > -- > 2.47.3 > > > -- Roland Hieber, Pengutronix e.K. | [email protected] | Steuerwalder Str. 21 | https://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
