Re: Why we should avoid new submodules if possible

[Ani Sinha]

On Tue, Jun 28, 2022 at 11:30 PM Michael S. Tsirkin <mst@redhat.com> wrote:
>
> On Tue, Jun 28, 2022 at 05:15:05PM +0100, Daniel P. Berrangé wrote:
> > FYI, the reason much of this is intentionally NOT under the /qemu-project
> > gitlab namespace is that we did not want to be responsible for distributing
> > arbitrary binary blobs/images. That in turn makes the QEMU project 
> > responsible
> > for license compliance, which is non-trivial todo correctly for much of this
> > stuff. As such it is highly desirable to delegate both the hosting the
> > binaries and source to the third party who builds it.
>
> This might be understadable for random guest OS images which include tons of 
> stuff
> and are thus hard to audit.  But not to biosbits which has its own
> license (more or less bsd) + gpl for grub:
> https://github.com/biosbits/bits/blob/master/COPYING

These are all the dependencies:
https://github.com/biosbits/bits/tree/master/deps

We can go through the licenses for each and make a determination. The
audit would be lost easier because there is a bounded number of
dependencies for bits.

>
> > I agree the use of personal github accounts is not nice, but it was the
> > least worst solution identified.
>
>
> --
> MST
>