Bug 1846139

 - Source must be a URL, or you must document how to generate the archive.

Source: mlxbf-aarch64-firmware.tar.gz

 - Not needed:

%defattr(644, root, root)

 - Latest tag is 3.0.beta1-2, please get the archive from Github directly

 - BetaX goes into Release field (as extraver) or use the tilde notation. See https://docs.fedoraproject.org/en-US/packaging-guidelines/Versioning/#_versioning_prereleases_with_tilde

Version: 3.0~beta1-2
Release: 2%{?dist}

- This is basically binary firmwares with no source on how to build them?

Policy on Firmware for the record

Some applications, drivers, and hardware require binary-only firmware to boot Fedora or function properly. Fedora permits inclusion of these files as long as they meet the following requirements:

Requirements:

  x  The files are non-executable within the Fedora OS context (note: this means that the files cannot run on their own, not that they are just chmod -x)
  x  The files are not libraries, within the Fedora OS context.
  x The files are standalone, not embedded in executable or library code (within the Fedora OS context).
  x The files must be necessary for the functionality of open source code being included in Fedora OR to enable Fedora to boot on a specific device, where no other reliable and supported mechanisms exist.
  x The files are available under an acceptable firmware license, which is included with the files in the packaging.

The Fedora Project considers a firmware license acceptable if:

    it allows some form of royalty-free use, subject to restrictions that the Fedora Project has determined are acceptable for firmware licenses (see below), and
    it does not restrict redistribution in ways that would make a software license unacceptable under Fedora licensing guidelines, except by:
        requiring that the firmware be redistributed only as incorporated in the redistributor's product (or as a maintenance update for existing end users of the redistributor's product), possibly limited further to those products of the redistributor that support or contain the hardware associated with the licensed firmware; and
        requiring the redistributor to pass on or impose conditions on users that are no more restrictive than those authorized by this Fedora firmware licensing policy.

A non-exhaustive list of restrictions on use that Fedora considers acceptable for firmware licenses are:

    any restrictions that are found in software licenses that are acceptable for Fedora;
    prohibitions on modification;
    prohibitions on reverse engineering, disassembly or decompilation;
    restricting use to use in conjunction with the hardware associated with the firmware license.

If you are unsure whether or not your files meet these requirements, ask on fedora-devel-list, and we will examine them for you.

The License tag for any firmware that disallows modification must be set to: "Redistributable, no modification permitted"

Firmware packages must be named <foo>-firmware, where <foo> is the driver or other hardware component that the firmware is for. In cases of firmware used to boot Fedora on a device, <foo> must be the type of device(s) that the firmware is intended for (e.g. raspberrypi). 

I'm gonna ask legal or devel to be sure.

Firmware should be sent to upstream repo: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/

Follow the instructions of: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/README

(In reply to Xose Vazquez Perez from comment #2)
> Firmware should be sent to upstream repo:
> https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/

No, I don't believe the early boot firmware such as ATF/UEFI etc fit the linux-firmware.

The question here is if it's for updating firmwares using UEFI capsule updates on a SPI flash or whether they have to be on the same storage as the OS. If it's capsule updates these firmwares should use the LVFS and be dealt with separately to the OS.

Any update on this BZ?

(In reply to Alaa Hleihel (NVIDIA Mellanox) from comment #4)
> Any update on this BZ?

See comment #3 https://bugzilla.redhat.com/show_bug.cgi?id=1846139#c3

(In reply to Peter Robinson from comment #5)
> (In reply to Alaa Hleihel (NVIDIA Mellanox) from comment #4)
> > Any update on this BZ?
> 
> See comment #3 https://bugzilla.redhat.com/show_bug.cgi?id=1846139#c3

Thanks, Peter.

@spencer
can you comment on that?

This is an automatic action taken by review-stats script.

The ticket submitter failed to clear the NEEDINFO flag in a month.
As per https://fedoraproject.org/wiki/Policy_for_stalled_package_reviews
we consider this ticket as DEADREVIEW and proceed to close it.