Re: [PATCH 1/3] scripts/make-release: Do not include the edk2 sources in the tarball anymore

[Daniel P . Berrangé]

On Mon, Jul 04, 2022 at 08:26:34AM +0100, Stefan Hajnoczi wrote:
> On Mon, 4 Jul 2022 at 07:45, Thomas Huth <thuth@redhat.com> wrote:
> >
> > The edk2 sources are bigger than the sources of QEMU - so they double the
> > size of our release tarballs if we include them. Fortunately, edk2 has a
> > permissive license, so there is no need for us to do this as long as we
> > continue to distribute the edk2 license information in our release tarball.
> >
> > Signed-off-by: Thomas Huth <thuth@redhat.com>
> > ---
> >  scripts/make-release | 27 +++++++++++++++++++++------
> >  1 file changed, 21 insertions(+), 6 deletions(-)
> >
> > diff --git a/scripts/make-release b/scripts/make-release
> > index 05b14ecc95..f79ed7a2ae 100755
> > --- a/scripts/make-release
> > +++ b/scripts/make-release
> > @@ -20,19 +20,34 @@ git checkout "v${version}"
> >  git submodule update --init
> >  (cd roms/seabios && git describe --tags --long --dirty > .version)
> >  (cd roms/skiboot && ./make_version.sh > .version)
> > -# Fetch edk2 submodule's submodules, since it won't have access to them via
> > -# the tarball later.
> > +
> > +# Fetch edk2 submodule's submodules to get their license information.
> > +# Edk2 is distributed under permissive licenses, so we don't have to
> > +# include the full source tree here (which is bigger than QEMU's sources)
> > +# as long as we provide the license information in the tarball.
> >  #
> >  # A more uniform way to handle this sort of situation would be nice, but we
> >  # don't necessarily have much control over how a submodule handles its
> >  # submodule dependencies, so we continue to handle these on a case-by-case
> >  # basis for now.
> > -(cd roms/edk2 && \
> > -    git submodule update --init -- \
> > +cd roms/edk2
> > +git submodule update --init --depth 1 -- \
> >          ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3 \
> >          BaseTools/Source/C/BrotliCompress/brotli \
> > -        CryptoPkg/Library/OpensslLib/openssl \
> > -        MdeModulePkg/Library/BrotliCustomDecompressLib/brotli)
> > +        CryptoPkg/Library/OpensslLib/openssl
> > +mv ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3/COPYING.txt \
> > +   License-softfloat.txt
> > +mv BaseTools/Source/C/BrotliCompress/brotli/LICENSE License-brotli.txt
> > +mv CryptoPkg/Library/OpensslLib/openssl/LICENSE License-openssl.txt
> > +edk2rev=$(git rev-parse --short=12 HEAD)
> > +rm -r $(ls | grep -v License) .[a-z]*
> > +cat > sources.txt <<EOF
> > +The edk2 sources can be downloaded from:
> > +
> > +https://github.com/tianocore/edk2/archive/${edk2rev}.tar.gz
> 
> Please use QEMU's edk2 mirror:
> https://gitlab.com/qemu-project/edk2
> 
> QEMU mirrors all dependencies so that even if upstream projects go
> offline we can still rebuild all of QEMU from source.

Note that the github/lab generated tarballs are not signed, while
QEMU's release tarballs are gpg signed, so from that POV this would
be a regression no matter which site we point to.

Also it would need more guidance on what to actually do with the
tarball, as if you merely unpack it into this dir, it won't work
as it will be one level of dirs nesting too deep for QEMU's
build scripts to work.

With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|