[ptxdist] [PATCH] host-imx-cst: change source origin to Debian snapshot

[ptxdist] [PATCH] host-imx-cst: change source origin to Debian snapshot

[Holger Assmann]

With the release of IMX-CST v4+ as only IMX_CST_TOOL_NEW variant, NXP no
longer provides any official download link for v3.4.1.

Switching to the latest release would require a lot of integration work
due to significant changes in the code base while not providing any
advantages for the platforms currently using v3.4.1.

We hence keep the former version for now and switch over to Debian
snapshot as source. This comes with the additional benefit of the
package now being aligned with the Debian Free Software Guidelines
(DFSG), which removes the need for accepting an EULA at the get stage.

Signed-off-by: Holger Assmann <h.assmann@pengutronix.de>
---
 rules/host-imx-cst.make | 30 +++++-------------------------
 1 file changed, 5 insertions(+), 25 deletions(-)

diff --git a/rules/host-imx-cst.make b/rules/host-imx-cst.make
index 68069aaa5..1d3f42c64 100644
--- a/rules/host-imx-cst.make
+++ b/rules/host-imx-cst.make
@@ -15,34 +15,14 @@ HOST_PACKAGES-$(PTXCONF_HOST_IMX_CST) += host-imx-cst
 # Paths and names
 #
 HOST_IMX_CST_VERSION	:= 3.4.1
-HOST_IMX_CST_MD5	:= b23ed5983734d4812fcf1da33eac8f31
+HOST_IMX_CST_MD5	:= 72aeb8e0394c3117c5a19da0e7e4fa84
 HOST_IMX_CST		:= cst-$(HOST_IMX_CST_VERSION)
-HOST_IMX_CST_SUFFIX	:= tgz
-HOST_IMX_CST_URL	:= https://www.nxp.com/webapp/sps/download/license.jsp?colCode=IMX_CST_TOOL_NEW
+HOST_IMX_CST_MOD	:= +dfsg.orig
+HOST_IMX_CST_SUFFIX	:= tar.xz
+HOST_IMX_CST_URL	:= https://snapshot.debian.org/archive/debian/20251014T030053Z/pool/main/i/imx-code-signing-tool/imx-code-signing-tool_$(HOST_IMX_CST_VERSION)$(HOST_IMX_CST_MOD).$(HOST_IMX_CST_SUFFIX)
 HOST_IMX_CST_SOURCE	:= $(SRCDIR)/$(HOST_IMX_CST).$(HOST_IMX_CST_SUFFIX)
 HOST_IMX_CST_DIR	:= $(HOST_BUILDDIR)/$(HOST_IMX_CST)
-HOST_IMX_CST_LICENSE	:= proprietary
-
-# ----------------------------------------------------------------------------
-# Get
-# ----------------------------------------------------------------------------
-
-$(HOST_IMX_CST_SOURCE):
-	@$(call targetinfo)
-	@echo "************************************************************************"
-	@echo "*"
-	@echo "* Due to license restrictions please download version $(HOST_IMX_CST_VERSION) manually from:"
-	@echo "*"
-	@echo "*    $(HOST_IMX_CST_URL)"
-	@echo "*"
-	@echo "* and place it into the source directory as:"
-	@echo "*"
-	@echo "*    $(HOST_IMX_CST_SOURCE)"
-	@echo "*"
-	@echo "*"
-	@echo "************************************************************************"
-	@echo
-	@exit 1
+HOST_IMX_CST_LICENSE	:= BSD-3-Clause AND BSD-2-Clause AND OpenSSL
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

Re: [ptxdist] [PATCH] host-imx-cst: change source origin to Debian snapshot

[Holger Assmann]

Hi,

I've just realized that I completely have left out proper linking of the
license files. Will come back with a v2.

Greetings,
Holger

-- 
Pengutronix e.K.                         | Holger Assmann              |
Steuerwalder Str. 21                     | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686         | Fax:   +49-5121-206917-5555 |

Re: [ptxdist] [PATCH] host-imx-cst: change source origin to Debian snapshot

[Roland Hieber]

On Fri, Oct 17, 2025 at 10:57:41AM +0200, Holger Assmann wrote:
> With the release of IMX-CST v4+ as only IMX_CST_TOOL_NEW variant, NXP no
> longer provides any official download link for v3.4.1.
> 
> Switching to the latest release would require a lot of integration work
> due to significant changes in the code base while not providing any
> advantages for the platforms currently using v3.4.1.
> 
> We hence keep the former version for now and switch over to Debian
> snapshot as source. This comes with the additional benefit of the
> package now being aligned with the Debian Free Software Guidelines
> (DFSG), which removes the need for accepting an EULA at the get stage.
> 
> Signed-off-by: Holger Assmann <h.assmann@pengutronix.de>
> ---
>  rules/host-imx-cst.make | 30 +++++-------------------------
>  1 file changed, 5 insertions(+), 25 deletions(-)
> 
> diff --git a/rules/host-imx-cst.make b/rules/host-imx-cst.make
> index 68069aaa5..1d3f42c64 100644
> --- a/rules/host-imx-cst.make
> +++ b/rules/host-imx-cst.make
> @@ -15,34 +15,14 @@ HOST_PACKAGES-$(PTXCONF_HOST_IMX_CST) += host-imx-cst
>  # Paths and names
>  #
>  HOST_IMX_CST_VERSION	:= 3.4.1
> -HOST_IMX_CST_MD5	:= b23ed5983734d4812fcf1da33eac8f31
> +HOST_IMX_CST_MD5	:= 72aeb8e0394c3117c5a19da0e7e4fa84
>  HOST_IMX_CST		:= cst-$(HOST_IMX_CST_VERSION)
> -HOST_IMX_CST_SUFFIX	:= tgz
> -HOST_IMX_CST_URL	:= https://www.nxp.com/webapp/sps/download/license.jsp?colCode=IMX_CST_TOOL_NEW
> +HOST_IMX_CST_MOD	:= +dfsg.orig
> +HOST_IMX_CST_SUFFIX	:= tar.xz
> +HOST_IMX_CST_URL	:= https://snapshot.debian.org/archive/debian/20251014T030053Z/pool/main/i/imx-code-signing-tool/imx-code-signing-tool_$(HOST_IMX_CST_VERSION)$(HOST_IMX_CST_MOD).$(HOST_IMX_CST_SUFFIX)
>  HOST_IMX_CST_SOURCE	:= $(SRCDIR)/$(HOST_IMX_CST).$(HOST_IMX_CST_SUFFIX)
>  HOST_IMX_CST_DIR	:= $(HOST_BUILDDIR)/$(HOST_IMX_CST)
> -HOST_IMX_CST_LICENSE	:= proprietary
> -
> -# ----------------------------------------------------------------------------
> -# Get
> -# ----------------------------------------------------------------------------
> -
> -$(HOST_IMX_CST_SOURCE):
> -	@$(call targetinfo)
> -	@echo "************************************************************************"
> -	@echo "*"
> -	@echo "* Due to license restrictions please download version $(HOST_IMX_CST_VERSION) manually from:"
> -	@echo "*"
> -	@echo "*    $(HOST_IMX_CST_URL)"
> -	@echo "*"
> -	@echo "* and place it into the source directory as:"
> -	@echo "*"
> -	@echo "*    $(HOST_IMX_CST_SOURCE)"
> -	@echo "*"
> -	@echo "*"
> -	@echo "************************************************************************"
> -	@echo
> -	@exit 1
> +HOST_IMX_CST_LICENSE	:= BSD-3-Clause AND BSD-2-Clause AND OpenSSL

Software_Content_Register_CST.txt mentions the three LICENSE.* files:
* LICENSE.openssl includes OpenSSL or Apache-2.0 licenses (depending on which
  version of OpenSSL is used) because it links to OpenSSL statically
* LICENSE.bsd3 is the BSD-3-Clause, this is also the only one whose references
  can be found with a `grep -R  SPDX-License` over the code base.
* LICENSE.hidapi is something else unknown to SPDX.

So:

HOST_IMX_CST_LICENSE := BSD-3-Clause AND (OpenSSL OR Apache-2.0) AND custom

HOST_IMX_CST_LICENSE_FILES := \
  file://Software_Content_Register_CST.txt;startline=5;endline=8;md5=58eeb2145e365237c49d5e91f6b10f7d \
  file://code/front_end/src/cst.c;startline=1;endline=5;md5=d3dc6d769e75ac1dd16b77d9ab467521 \
  file://LICENSE.bsd3;md5=14aba05f9fa6c25527297c8aac95fcf6 \
  file://LICENSE.openssl;md5=3441526b1df5cc01d812c7dfc218cea6 \
  file://LICENSE.hidapi;md5=e0ea014f523f64f0adb13409055ee59e

 - Roland

>  
>  # ----------------------------------------------------------------------------
>  # Prepare
> -- 
> 2.47.3
> 
> 
> 

-- 
Roland Hieber, Pengutronix e.K.          | rhi@pengutronix.de          |
Steuerwalder Str. 21                     | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686         | Fax:   +49-5121-206917-5555 |