-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 21/11/13 11:00, Jonathan Wilson wrote: >> However, would it not be a better practice to maintain the FL/OSS parts > in an internal repository as an integral part of the device development > process, tag each firmware release, and simply push >> that to a public (git) repository or produce a tar-ball? > It would be impossible to expect that every change to a FOSS package (kernel, > busybox, whatever else) be vetted to make sure its legally clean and > releasable before it was pushed to the internal > tree.
I disagree completely - in fact it makes the process much easier for both developers and legal bodies to review. In the case of projects based on the Linux kernel the cleanest work-flow is to use git as the DVCS, and in particular its submodule abilities, where the master repository is for the device, and the submodules are for the components that make up the entire project - FL/OS and proprietary, e.g.: mkdir our_device_01 && cd our_device_01 git init mkdir legal git add legal git commit -s -S$MY_GPG_KEYID -m 'Keep all legal correspondence here' git remote add public ssh://[email protected]:~/git/our_device_01.git git submodule add git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git linux git submodule init linux git submodule add git://busybox.net/busybox.git busybox git submodule init busybox ... git submodule foreach git remote add public ssh://[email protected]:~/git/$name ... cat >open_source_submodules.list <<EOT linux busybox EOT git add open_source_submodules.list git commit -s -S$MY_GPG_KEYID -m 'list of Open Source submodules to be publicly released' ... git submodule add file://path/to/internal/closed-source/project_1 proprietary_project_1 git submodule init proprietary_project_1 ... git branch -b new-feature-01 ... git add . git commit -s -S$MY_GPG_KEYID -m 'Integrate new feature 01' ... mailx -c [email protected] -s "Please review branch new-feature-01 of project our_device_01" [email protected] ... # read email mailx O 1 legal@@myco.com Thu Nov 21 16:01 31/545 "Release Approved" # approval received type 1 save +legal exit git add legal/* git commit -s -S$MY_GPG_KEYID -m 'Release Approved' git checkout master git merge new_feature_01 git tag -s -m "Add new feature 01" ... for module in open_source_submodules.list; do pushd $module git push public master popd done This allows per-commit traceability in the device project and all its constituent parts, with clean and obvious separation between the FL/OS and closed-source parts. When the firmware is ready for release it is straight-forward to review the commits to the FL/OS parts before signing it off with a signed tag in the master repo which also binds the state of the submodules. The FL/OS parts can then be pushed to a public repository or tar-balled. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlKOQ0AACgkQ7+w3pCnNYIBxOACdHvJL/jO5OytxhYW89ep3/qJK IOoAoOjYpP+FE414oBG6ZPHrk20OvCV+ =PQj7 -----END PGP SIGNATURE-----
