Licensing and provenance information missing

[pabigot]

I recently submitted a patch to meta-raspberrypi that provided the BCM4345C0.hcd firmware required for 3B+ bluetooth support, copied from this repository. Afterwards, I realized I might need to update the recipe license information to match.

This repository does not appear to contain information about the licensing of these firmware images. BCM-LEGAL.txt contains only a copyright, with the last date fifteen (!) years ago.

The COPYING and README files contain no suggestion that these files have proprietary or non-free licensing.

In fact, I can't even figure out where this material came from. Google for bluez-firmware_1.2-3+rpt4.1.debian mostly finds this repository. https://tracker.debian.org/pkg/bluez-firmware exists but it's six years old and doesn't contain the files this repository has.

Would you please update this repository with provenance and possibly SPDX information?

Thanks.

[XECDesign]

@pelwell Would you happen to have a license we can add?

[pelwell]

No, but I'll raise it with Cypress.

[pelwell]

BTW, the BCM43438 firmware is covered by https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/LICENCE.broadcom_bcm43xx.

[pelwell]

Cypress have finally responded - we should use this licence: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/LICENCE.cypress

[XECDesign]

Do we use that cypress license for all the binary files in the broadcom directory or just the .hcd files we've updated?

[pelwell]

My question to Cypress was:

We make the firmware for the Raspberry Pi's BT and WiFi firmware (43438 and 43455) available for use in third party OS images, etc. Can you confirm the license that you would like associated with that firmware?

And you know the answer, so the implication is all of them.

[pabigot]

I don't believe this is resolved to the degree needed by Yocto's meta-raspberrypi, which provides packages for this and firmware-nonfree in different formats for use on Raspberry PI devices. The license information was only updated in debian files, and is not in a form where it can be installed on the target system. I think LICENSE.cypress needs to be in the root of this repository, and some text added somewhere explaining what it applies to. I've submitted #2 for that.

Also, I suspect @pelwell's conclusion about coverage is mistaken, unless Cypress also provided the BCM2033 files that are in the package. If not, those should still be covered by Broadcom's license, which either should be added, or the BCM2033 files removed.

Finally, if Cypress provided anything that's in firmware-nonfree (such as brcmfmac43430* and brcmfmac43455*) then the same information needs to be put there.

Or so I propose, not being a lawyer nor legally associated with Raspberry PI nor Yocto.

[pabigot]

Licensing and provenance is now satisfactorily managed in meta-raspberrypi. If there's no need for a standalone license in this repo then from my perspective this issue and #2 can be closed. Thanks for the clarifications.