Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bugzilla DB migration completed. Please report issues to Infra team via email via infra@gentoo.org or IRC
Bug 689396 - sys-block/sas2ircu should not be fetch-restricted
Summary: sys-block/sas2ircu should not be fetch-restricted
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Licenses team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-07-07 07:23 UTC by Aaron Stein
Modified: 2019-07-08 05:32 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Aaron Stein 2019-07-07 07:23:52 UTC
The current ebuilds refuse to fetch and say the following:
pkg_nofetch() {
	elog "LSI has a mandatory click-through license on thier binaries."
	elog "Please visit $HOMEPAGE and download ${DISTFILE_BIN} from the Management Software and Tools section."
	elog "After downloading, move ${DISTFILE_BIN} into your DISTDIR directory"
	if use doc; then
		elog "Please also download 'SAS-2 Integrated RAID Configuration Utility User Guide' (${DISTFILE_DOC}) "
		elog "and also place it into your DISTDIR directory"
	fi
}

This is a terrible way to get the file, because the Broadcom website is continuously changing, and having to manually access a bloated page that requires javascript is highly inconvenient or impossible in many cases. Additionally, Broadcom has entirely removed version 19 from its website. However, I took a look at the license and I believe that we are allowed to have portage fetch the file normally, and also to host it on source mirrors, in the usual way. The ebuild should not be fetch-restricted.

The license first says this: "BY OPENING THE SOFTWARE PACKAGE, CLICKING ON THE "ACCEPT" BUTTON OF ANY ELECTRONIC VERSION OF THIS AGREEMENT OR ACCESSING OR INSTALLING THE SOFTWARE, YOU ACKNOWLEDGE THAT YOU HAVE READ THE AGREEMENT, UNDERSTAND IT AND AGREE TO BE BOUND BY ITS TERMS AND CONDITIONS. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, DO NOT DOWNLOAD, INSTALL, COPY OR USE THE SOFTWARE."
Therefore, requiring the user to accept this license within portage with LICENSE="LSI" is more than sufficient.

Secondly, the license says this: "Subject to the terms and conditions of this Agreement, Broadcom grants to Licensee the limited, non-exclusive, non-transferable, personal, revocable right, without a right to sublicense, solely to (i) internally evaluate and use the Software only in connection with proprietary products of Broadcom incorporated in and/or that directly interoperate with Licensee products, and to make one (1) copy of the Software for back-up or archival purposes only, and (ii) reproduce and distribute, in object code form only, copies of the Software only as incorporated in Licensee products and/or for use with Licensee products that directly interoperate with Broadcom Products, through multiple tiers of distribution to resellers, distributors and end users of such Licensee products."
By distributing the download URL of the software, and when the Gentoo source mirrors host the software, we are complying with part ii, by reproducing and distributing, in object code form only, copies of the Software for use with Licensee products (Gentoo) that directly interoperate with Broadcom Products, through multiple tiers of distribution to end users of such Licensee products (Gentoo users).

Therefore, I believe that we are allowed to have portage fetch the file normally without restriction, and the SRC_URI in sys-block/sas2ircu-20 still works so it is a trivial change. Perhaps sys-block/sas2ircu-19 should be removed.

The alternative, with most of the aforementioned disadvantages, is to change the instructions to send the user to https://docs.broadcom.com/docs/SAS2IRCU_P20.zip , which (for now) will allow them to immediately click through the license and start the download, without having to navigate a poorly designed download page like the current HOMEPAGE. However, this is still likely to change in the future, or disappear completely like version 19.
Comment 1 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2019-07-07 21:59:49 UTC
licenses:
I think it's possible the LSI license texts have changed, esp. wrt to what's on the click-through agreement vs the license files we have vs the license in the distfiles.

They should be reviewed and see what the updated restriction should be.

Maybe also check other distros to see what they are doing presently.
Comment 2 Ulrich Müller gentoo-dev 2019-07-08 05:32:56 UTC
Right, upstream terms have changed, and should be added as a new license file.

By its wording it still appears to be an EULA, so I don't think that we could lift the mirror restriction.