As I said, it's fine to use versions that are shipped in the upstream tarball; I certainly don't care whether the files live in the qemu-kvm package or in vgabios etc. Regardless of this, though, we need to provide source for them or we are infringing the licence on at least the LGPLed BIOS ROMs. Upstream QEMU is not the copyright owner for all of this stuff, as far as I can tell, and does not have the authority to waive our obligations.
Aside from legal obligations, we're also skating along the edge of our own licensing policy by not shipping source: http://www.ubuntu.com/community/ubuntustory/licensing. One might point out that BIOS ROMs are firmware and thus might be eligible for a case-by-case exception. Such exceptions were only meant to be granted when the only way we could get some piece of hardware working was to ship some bit of firmware we only had in the form of a binary blob. I don't think anyone ever envisaged that the reason we might be shipping binary blobs would be because it was too hard to build from source accurately, and this doesn't seem like a good basis for an exception. I would strongly recommend building the ROMs from matching source code (I don't think source is really source unless we're actually building the binaries from it - part of the point of shipping source is so that people can make modifications, and if the source doesn't verifiably match what we're shipping then that rather defeats the point). If you're concerned that it might not match, then perhaps you could simply compare it against a checksum after building, with a comment saying that this is to ensure that they match the versions that have been QAed by upstream? I'd have thought that the sort of compilation being done here is using fairly static toolchain elements and thus would produce fairly static output, which would require at most minor massaging to become bitwise-identical to what upstream's shipping. On Thu, Mar 18, 2010 at 10:19:16PM -0000, Dustin Kirkland wrote: > d) package mol, and depend on mol video.x is already in the mol-drivers-macosx package (powerpc only); mol has been in the Ubuntu archive since at least Hoary and I think since the very beginning. It's not identical to the one in qemu-common, although the two files are the same size. mol-drivers-macosx is in multiverse, and in Debian it's in non-free. This is because it is licensed under the AFPL 1.2, which forbids "deploying" modified versions within an organisation without publishing them, which is a restriction on privacy that we don't want in main. See http://www.gnu.org/philosophy/historical-apsl.html for more discussion here. Right now, qemu-kvm's copyright file doesn't mention the copyright or licence for any of the BIOS ROMs, much less this problem. Unless there's been an APSL 2 release of MOL, I don't think we can legitimately include video.x in qemu-kvm, nor depend on mol-drivers-macosx. -- BIOS shipped as binary blobs without source https://bugs.launchpad.net/bugs/541524 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to qemu-kvm in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
