On Tue, Jun 28, 2022 at 11:30 PM Michael S. Tsirkin <mst@redhat.com> wrote:
On Tue, Jun 28, 2022 at 05:15:05PM +0100, Daniel P. Berrangé wrote:
FYI, the reason much of this is intentionally NOT under the /qemu-project
gitlab namespace is that we did not want to be responsible for distributing
arbitrary binary blobs/images. That in turn makes the QEMU project responsible
for license compliance, which is non-trivial todo correctly for much of this
stuff. As such it is highly desirable to delegate both the hosting the
binaries and source to the third party who builds it.
This might be understadable for random guest OS images which include tons of
stuff
and are thus hard to audit. But not to biosbits which has its own
license (more or less bsd) + gpl for grub:
https://github.com/biosbits/bits/blob/master/COPYING
These are all the dependencies:
https://github.com/biosbits/bits/tree/master/deps
We can go through the licenses for each and make a determination. The
audit would be lost easier because there is a bounded number of
dependencies for bits.