Bug#890601: Source Package Doesn't Contain Source

[Jason Self]

Package: firmware-linux-free
Version: 3.4

It appears that the source package for firmware-linux-free contains the
firmware binaries downloaded from linux-firmware.git. Shouldn't a source
package contain, you know, the source code? Especially as some of the
firmwares are GPL-licensed, and Debian is shipping only the binaries.

In looking into other distros it seems that that most don't compile the
firmware from source either. As a result people don't notice when the tools
to do so break. For example: The as31 assembler needed to build the usbdux
firmware currently segfaults. Reference bug #887320.

[Jonathan Nieder]

Hi Jason,

Jason Self wrote:

> It appears that the source package for firmware-linux-free contains the
> firmware binaries downloaded from linux-firmware.git. Shouldn't a source
> package contain, you know, the source code? Especially as some of the
> firmwares are GPL-licensed, and Debian is shipping only the binaries.

Can you be more specific? Which file have you found in the source
package that does not have corresponding source included?

> In looking into other distros it seems that that most don't compile the
> firmware from source either. As a result people don't notice when the tools
> to do so break. For example: The as31 assembler needed to build the usbdux
> firmware currently segfaults. Reference bug #887320.

That sounds like a different bug report: "package doesn't build from
source".

Thanks and hope that helps,
Jonathan

[Jason Self]

Jonathan Nieder <jrni...@gmail.com> wrote ..

> Can you be more specific? Which file have you found in the source
> package that does not have corresponding source included?

OK; perhaps this bug needs re-titling. There seems to be "a" source
present, but the programs don't appear to be built from it.

What started this is that I tried to build the usbdux firmware from
source and found that the assembler needed to build the firmware
segfaulted when trying to do so. Curious as to how Debian got the
firmware to build I checked out the firmware-free package. The answer
seems to be: They didn't; they just use the binaries from linux-
firmware.git. (The sha512 hashes appear to be identical.)

If they were built from source then the build dependencies for firmware-
free would be bigger (such as, among others, depending on as31 in order
to build the usbdux firmware) and the breakage of tools needed to build
the firmware would have been noticed.

Surely including auto-generated files and/or just re-cycling upstream's
binaries in a source package either is or should be some sort of policy
violation? Building from source would help to ensure that the provided
source is complete, corresponding, and buildable. It would also be
consistent with the proposed stuff for JavaScript to exclude auto-
generated files from source.

[Jonathan Nieder]

retitle 890601 firmware-linux-free uses prebuilt blobs instead of building from source
severity 890601 wishlist
quit

Jason Self wrote:
> Jonathan Nieder <jrni...@gmail.com> wrote ..

>> Can you be more specific? Which file have you found in the source
>> package that does not have corresponding source included?
>
> OK; perhaps this bug needs re-titling. There seems to be "a" source
> present, but the programs don't appear to be built from it.

Thanks for clarifying.

I agree that fixing that is a worthwhile project, though it's hard to
do (e.g. because of the current state of cross-compilers in the
archive). Retitling and setting severity based on my understanding of
kernel team's current plans.

Thanks,
Jonathan

[Debian Bug Tracking System]

Processing commands for con...@bugs.debian.org:

> retitle 890601 firmware-linux-free uses prebuilt blobs instead of building from source

Bug #890601 [firmware-linux-free] Source Package Doesn't Contain Source
Changed Bug title to 'firmware-linux-free uses prebuilt blobs instead of building from source' from 'Source Package Doesn't Contain Source'.
> severity 890601 wishlist
Bug #890601 [firmware-linux-free] firmware-linux-free uses prebuilt blobs instead of building from source
Severity set to 'wishlist' from 'normal'
> quit
Stopping processing here.

Please contact me if you need assistance.
--
890601: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890601
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

[Bastian Germann]

carl9170fw just got into experimental so it can soon be replaced.

Besides this, I have created a MR which builds other firmware from source:
https://salsa.debian.org/kernel-team/firmware-free/-/merge_requests/4

The only things left to build are the cis/* and keyspan_pda/* files which
need tools that are not packaged (ihex2fw from the kernel source and pack_cis).

[Bastian Germann]

Control: block -1 by 1050989

On Fri, 1 Sep 2023 11:08:21 +0200 Bastian Germann <ba...@debian.org> wrote:
> carl9170fw just got into experimental so it can soon be replaced.

Can you please drop carl9170-1.fw and the associated things from the package?
The carl9170fw package should be ready with revision 1.9.9-399-gcd480b9-1.1.
The only missing thing is a Breaks/Replaces which I would like to fill in as
soon as you have decided on the firmware-free revision that drops it.

[Bastian Germann]

On Tue, 5 Sep 2023 17:30:44 +0200 Bastian Germann <ba...@debian.org> wrote:
> Can you please drop carl9170-1.fw and the associated things from the package?
> The carl9170fw package should be ready with revision 1.9.9-399-gcd480b9-1.1.
> The only missing thing is a Breaks/Replaces which I would like to fill in as
> soon as you have decided on the firmware-free revision that drops it.

Ping. There have been two firmware-free uploads since my request.
Would you please comment on this? I would like to get this into trixie.