Re: [ptxdist] [PATCH] host-imx-cst: change source origin to Debian snapshot

[Roland Hieber <rhi@pengutronix.de>]

On Fri, Oct 17, 2025 at 10:57:41AM +0200, Holger Assmann wrote:
> With the release of IMX-CST v4+ as only IMX_CST_TOOL_NEW variant, NXP no
> longer provides any official download link for v3.4.1.
> 
> Switching to the latest release would require a lot of integration work
> due to significant changes in the code base while not providing any
> advantages for the platforms currently using v3.4.1.
> 
> We hence keep the former version for now and switch over to Debian
> snapshot as source. This comes with the additional benefit of the
> package now being aligned with the Debian Free Software Guidelines
> (DFSG), which removes the need for accepting an EULA at the get stage.
> 
> Signed-off-by: Holger Assmann <h.assmann@pengutronix.de>
> ---
>  rules/host-imx-cst.make | 30 +++++-------------------------
>  1 file changed, 5 insertions(+), 25 deletions(-)
> 
> diff --git a/rules/host-imx-cst.make b/rules/host-imx-cst.make
> index 68069aaa5..1d3f42c64 100644
> --- a/rules/host-imx-cst.make
> +++ b/rules/host-imx-cst.make
> @@ -15,34 +15,14 @@ HOST_PACKAGES-$(PTXCONF_HOST_IMX_CST) += host-imx-cst
>  # Paths and names
>  #
>  HOST_IMX_CST_VERSION	:= 3.4.1
> -HOST_IMX_CST_MD5	:= b23ed5983734d4812fcf1da33eac8f31
> +HOST_IMX_CST_MD5	:= 72aeb8e0394c3117c5a19da0e7e4fa84
>  HOST_IMX_CST		:= cst-$(HOST_IMX_CST_VERSION)
> -HOST_IMX_CST_SUFFIX	:= tgz
> -HOST_IMX_CST_URL	:= https://www.nxp.com/webapp/sps/download/license.jsp?colCode=IMX_CST_TOOL_NEW
> +HOST_IMX_CST_MOD	:= +dfsg.orig
> +HOST_IMX_CST_SUFFIX	:= tar.xz
> +HOST_IMX_CST_URL	:= https://snapshot.debian.org/archive/debian/20251014T030053Z/pool/main/i/imx-code-signing-tool/imx-code-signing-tool_$(HOST_IMX_CST_VERSION)$(HOST_IMX_CST_MOD).$(HOST_IMX_CST_SUFFIX)
>  HOST_IMX_CST_SOURCE	:= $(SRCDIR)/$(HOST_IMX_CST).$(HOST_IMX_CST_SUFFIX)
>  HOST_IMX_CST_DIR	:= $(HOST_BUILDDIR)/$(HOST_IMX_CST)
> -HOST_IMX_CST_LICENSE	:= proprietary
> -
> -# ----------------------------------------------------------------------------
> -# Get
> -# ----------------------------------------------------------------------------
> -
> -$(HOST_IMX_CST_SOURCE):
> -	@$(call targetinfo)
> -	@echo "************************************************************************"
> -	@echo "*"
> -	@echo "* Due to license restrictions please download version $(HOST_IMX_CST_VERSION) manually from:"
> -	@echo "*"
> -	@echo "*    $(HOST_IMX_CST_URL)"
> -	@echo "*"
> -	@echo "* and place it into the source directory as:"
> -	@echo "*"
> -	@echo "*    $(HOST_IMX_CST_SOURCE)"
> -	@echo "*"
> -	@echo "*"
> -	@echo "************************************************************************"
> -	@echo
> -	@exit 1
> +HOST_IMX_CST_LICENSE	:= BSD-3-Clause AND BSD-2-Clause AND OpenSSL

Software_Content_Register_CST.txt mentions the three LICENSE.* files:
* LICENSE.openssl includes OpenSSL or Apache-2.0 licenses (depending on which
  version of OpenSSL is used) because it links to OpenSSL statically
* LICENSE.bsd3 is the BSD-3-Clause, this is also the only one whose references
  can be found with a `grep -R  SPDX-License` over the code base.
* LICENSE.hidapi is something else unknown to SPDX.

So:

HOST_IMX_CST_LICENSE := BSD-3-Clause AND (OpenSSL OR Apache-2.0) AND custom

HOST_IMX_CST_LICENSE_FILES := \
  file://Software_Content_Register_CST.txt;startline=5;endline=8;md5=58eeb2145e365237c49d5e91f6b10f7d \
  file://code/front_end/src/cst.c;startline=1;endline=5;md5=d3dc6d769e75ac1dd16b77d9ab467521 \
  file://LICENSE.bsd3;md5=14aba05f9fa6c25527297c8aac95fcf6 \
  file://LICENSE.openssl;md5=3441526b1df5cc01d812c7dfc218cea6 \
  file://LICENSE.hidapi;md5=e0ea014f523f64f0adb13409055ee59e

 - Roland

>  
>  # ----------------------------------------------------------------------------
>  # Prepare
> -- 
> 2.47.3
> 
> 
> 

-- 
Roland Hieber, Pengutronix e.K.          | rhi@pengutronix.de          |
Steuerwalder Str. 21                     | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686         | Fax:   +49-5121-206917-5555 |