Comment 2 for bug 541524

As I said, it's fine to use versions that are shipped in the upstream
tarball; I certainly don't care whether the files live in the qemu-kvm
package or in vgabios etc. Regardless of this, though, we need to
provide source for them or we are infringing the licence on at least the
LGPLed BIOS ROMs. Upstream QEMU is not the copyright owner for all of
this stuff, as far as I can tell, and does not have the authority to
waive our obligations.

Aside from legal obligations, we're also skating along the edge of our
own licensing policy by not shipping source:
http://www.ubuntu.com/community/ubuntustory/licensing. One might point
out that BIOS ROMs are firmware and thus might be eligible for a
case-by-case exception. Such exceptions were only meant to be granted
when the only way we could get some piece of hardware working was to
ship some bit of firmware we only had in the form of a binary blob. I
don't think anyone ever envisaged that the reason we might be shipping
binary blobs would be because it was too hard to build from source
accurately, and this doesn't seem like a good basis for an exception.

I would strongly recommend building the ROMs from matching source code
(I don't think source is really source unless we're actually building
the binaries from it - part of the point of shipping source is so that
people can make modifications, and if the source doesn't verifiably
match what we're shipping then that rather defeats the point). If
you're concerned that it might not match, then perhaps you could simply
compare it against a checksum after building, with a comment saying that
this is to ensure that they match the versions that have been QAed by
upstream? I'd have thought that the sort of compilation being done here
is using fairly static toolchain elements and thus would produce fairly
static output, which would require at most minor massaging to become
bitwise-identical to what upstream's shipping.

On Thu, Mar 18, 2010 at 10:19:16PM -0000, Dustin Kirkland wrote:
> d) package mol, and depend on mol

video.x is already in the mol-drivers-macosx package (powerpc only); mol
has been in the Ubuntu archive since at least Hoary and I think since
the very beginning. It's not identical to the one in qemu-common,
although the two files are the same size.

mol-drivers-macosx is in multiverse, and in Debian it's in non-free.
This is because it is licensed under the AFPL 1.2, which forbids
"deploying" modified versions within an organisation without publishing
them, which is a restriction on privacy that we don't want in main. See
http://www.gnu.org/philosophy/historical-apsl.html for more discussion
here. Right now, qemu-kvm's copyright file doesn't mention the
copyright or licence for any of the BIOS ROMs, much less this problem.

Unless there's been an APSL 2 release of MOL, I don't think we can
legitimately include video.x in qemu-kvm, nor depend on
mol-drivers-macosx.