Bug#890601: firmware-free: Source Package Doesn't Contain Source

[Salvatore Bonaccorso]

Hi Ben,

On Mon, Feb 19, 2024 at 09:27:07PM +0100, Bastian Germann wrote:
> On Tue, 5 Sep 2023 17:30:44 +0200 Bastian Germann  wrote:
> > Can you please drop carl9170-1.fw and the associated things from the 
> > package?
> > The carl9170fw package should be ready with revision 1.9.9-399-gcd480b9-1.1.
> > The only missing thing is a Breaks/Replaces which I would like to fill in as
> > soon as you have decided on the firmware-free revision that drops it.
> 
> Ping. There have been two firmware-free uploads since my request.
> Would you please comment on this? I would like to get this into trixie.

Would you be fine with those changes s proposed by Bastian, or want to
have it handled differently?

https://salsa.debian.org/kernel-team/firmware-free/-/merge_requests/4/diffs?commit_id=487a3891528cdf363f97c5ff20f9c6dcb6f49c33

Regards,
Salvatore

Bug#890601: firmware-free: Source Package Doesn't Contain Source

[Bastian Germann]

On Tue, 5 Sep 2023 17:30:44 +0200 Bastian Germann  wrote:

Can you please drop carl9170-1.fw and the associated things from the package?
The carl9170fw package should be ready with revision 1.9.9-399-gcd480b9-1.1.
The only missing thing is a Breaks/Replaces which I would like to fill in as
soon as you have decided on the firmware-free revision that drops it.


Ping. There have been two firmware-free uploads since my request.
Would you please comment on this? I would like to get this into trixie.

Bug#890601: firmware-free: Source Package Doesn't Contain Source

[Bastian Germann]

Control: block -1 by 1050989

On Fri, 1 Sep 2023 11:08:21 +0200 Bastian Germann  wrote:

carl9170fw just got into experimental so it can soon be replaced.


Can you please drop carl9170-1.fw and the associated things from the package?
The carl9170fw package should be ready with revision 1.9.9-399-gcd480b9-1.1.
The only missing thing is a Breaks/Replaces which I would like to fill in as
soon as you have decided on the firmware-free revision that drops it.

Bug#890601: firmware-free: Source Package Doesn't Contain Source

[Bastian Germann]

carl9170fw just got into experimental so it can soon be replaced.

Besides this, I have created a MR which builds other firmware from source:
https://salsa.debian.org/kernel-team/firmware-free/-/merge_requests/4

The only things left to build are the cis/* and keyspan_pda/* files which
need tools that are not packaged (ihex2fw from the kernel source and pack_cis).

Bug#890601: firmware-free: Source Package Doesn't Contain Source

[Jonathan Nieder]

retitle 890601 firmware-linux-free uses prebuilt blobs instead of building from 
source
severity 890601 wishlist
quit

Jason Self wrote:
> Jonathan Nieder  wrote ..

>> Can you be more specific?  Which file have you found in the source
>> package that does not have corresponding source included?
>
> OK; perhaps this bug needs re-titling. There seems to be "a" source 
> present, but the programs don't appear to be built from it.

Thanks for clarifying.

I agree that fixing that is a worthwhile project, though it's hard to
do (e.g. because of the current state of cross-compilers in the
archive).  Retitling and setting severity based on my understanding of
kernel team's current plans.

Thanks,
Jonathan

Bug#890601: firmware-free: Source Package Doesn't Contain Source

[Jason Self]

Jonathan Nieder  wrote ..

> Can you be more specific?  Which file have you found in the source
> package that does not have corresponding source included?

OK; perhaps this bug needs re-titling. There seems to be "a" source 
present, but the programs don't appear to be built from it.

What started this is that I tried to build the usbdux firmware from 
source and found that the assembler needed to build the firmware 
segfaulted when trying to do so. Curious as to how Debian got the 
firmware to build I checked out the firmware-free package. The answer 
seems to be: They didn't; they just use the binaries from linux-
firmware.git. (The sha512 hashes appear to be identical.)

If they were built from source then the build dependencies for firmware-
free would be bigger (such as, among others, depending on as31 in order 
to build the usbdux firmware) and the breakage of tools needed to build 
the firmware would have been noticed.

Surely including auto-generated files and/or just re-cycling upstream's 
binaries in a source package either is or should be some sort of policy 
violation? Building from source would help to ensure that the provided 
source is complete, corresponding, and buildable. It would also be 
consistent with the proposed stuff for JavaScript to exclude auto-
generated files from source.

Bug#890601: firmware-free: Source Package Doesn't Contain Source

[Jonathan Nieder]

Hi Jason,

Jason Self wrote:

> It appears that the source package for firmware-linux-free contains the
> firmware binaries downloaded from linux-firmware.git. Shouldn't a source
> package contain, you know, the source code? Especially as some of the
> firmwares are GPL-licensed, and Debian is shipping only the binaries.

Can you be more specific?  Which file have you found in the source
package that does not have corresponding source included?

> In looking into other distros it seems that that most don't compile the
> firmware from source either. As a result people don't notice when the tools
> to do so break. For example: The as31 assembler needed to build the usbdux
> firmware currently segfaults. Reference bug #887320.

That sounds like a different bug report: "package doesn't build from
source".

Thanks and hope that helps,
Jonathan