Public bug reported: This is an umbrella MIR re-review bug for linux-firmware and the linux-firmware-<split> source packages per https://ubuntu.com/project/docs/MIR/mir-rereview/.
The complete source package list (19 source packages): - linux-firmware - linux-firmware-amd-graphics - linux-firmware-amd-misc - linux-firmware-broadcom-wireless - linux-firmware-intel-graphics - linux-firmware-intel-misc - linux-firmware-intel-wireless - linux-firmware-marvell-prestera - linux-firmware-marvell-wireless - linux-firmware-mediatek - linux-firmware-mellanox-spectrum - linux-firmware-misc - linux-firmware-netronome - linux-firmware-nvidia-graphics - linux-firmware-qlogic - linux-firmware-qualcomm-graphics - linux-firmware-qualcomm-misc - linux-firmware-qualcomm-wireless - linux-firmware-realtek Binary packages built (20 binary packages): - linux-firmware (metapackage) - linux-firmware-minimal (metapackage) - linux-firmware-amd-graphics - linux-firmware-amd-misc - linux-firmware-broadcom-wireless - linux-firmware-intel-graphics - linux-firmware-intel-misc - linux-firmware-intel-wireless - linux-firmware-marvell-prestera - linux-firmware-marvell-wireless - linux-firmware-mediatek - linux-firmware-mellanox-spectrum - linux-firmware-misc - linux-firmware-netronome - linux-firmware-nvidia-graphics - linux-firmware-qlogic - linux-firmware-qualcomm-graphics - linux-firmware-qualcomm-misc - linux-firmware-qualcomm-wireless - linux-firmware-realtek All source packages are built from a single git repository: https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux-firmware [Availability] - All the above listed packages are already in Ubuntu main. - All packages build for architecture: all (Architecture: all). - Links to source packages on Launchpad: - https://launchpad.net/ubuntu/+source/linux-firmware - https://launchpad.net/ubuntu/+source/linux-firmware-amd-graphics - https://launchpad.net/ubuntu/+source/linux-firmware-amd-misc - https://launchpad.net/ubuntu/+source/linux-firmware-broadcom-wireless - https://launchpad.net/ubuntu/+source/linux-firmware-intel-graphics - https://launchpad.net/ubuntu/+source/linux-firmware-intel-misc - https://launchpad.net/ubuntu/+source/linux-firmware-intel-wireless - https://launchpad.net/ubuntu/+source/linux-firmware-marvell-prestera - https://launchpad.net/ubuntu/+source/linux-firmware-marvell-wireless - https://launchpad.net/ubuntu/+source/linux-firmware-mediatek - https://launchpad.net/ubuntu/+source/linux-firmware-mellanox-spectrum - https://launchpad.net/ubuntu/+source/linux-firmware-misc - https://launchpad.net/ubuntu/+source/linux-firmware-netronome - https://launchpad.net/ubuntu/+source/linux-firmware-nvidia-graphics - https://launchpad.net/ubuntu/+source/linux-firmware-qlogic - https://launchpad.net/ubuntu/+source/linux-firmware-qualcomm-graphics - https://launchpad.net/ubuntu/+source/linux-firmware-qualcomm-misc - https://launchpad.net/ubuntu/+source/linux-firmware-qualcomm-wireless - https://launchpad.net/ubuntu/+source/linux-firmware-realtek [Rationale] # -------- Demand - The package linux-firmware is required in Ubuntu main because Ubuntu Linux kernels depend on it. linux-firmware provides firmware binaries that the kernel loads and requires for hardware devices to function correctly. - The package linux-firmware is a metapackage that depends on all the split firmware packages that provide the actual binaries. Hence all split firmware packages need to be in Ubuntu main to satisfy the dependency chain. - The packages will generally be useful for a large part of our user base across all installations (covering GPU, WiFi, Bluetooth, Ethernet/network switches, storage, audio/NPUs, etc.). # -------- Alternatives - There is no other/better way to solve this that is already in main or should go universe->main instead of this. Upstream kernel drivers specifically require firmware provided by the kernel.org linux-firmware repository. # -------- Prior-art - Historically, linux-firmware was a single monolithic package that has been in Ubuntu main since the earliest releases, but never had an official MIR review. - The package was subsequently split into smaller subpackages (LP: #1958518, LP: #2146533). - Per the Ubuntu MIR re-review policy, this MIR re-review establishes the formal review and audit trail for linux-firmware and the split packages that inherited main status from the monolith. # -------- Main-vs-universe - All binary packages built by linux-firmware and the split source packages need to be in main to achieve hardware enablement for the standard Ubuntu kernels in main out of the box. # -------- Deadline - The packages are already in main so there's no urgency for this. [Security] # -------- CVE-history - Had security issues in the past, primarily security vulnerabilities reported against vendor firmware blobs tracked in Ubuntu CVE Tracker: https://ubuntu.com/security/cve?package=linux-firmware - Upstream releases new git tags/snapshots containing updated firmware blobs from vendors to address these vulnerabilities, which are subsequently packaged and uploaded to Ubuntu. # -------- Security-sensitive-behavior - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Packages do not install services, timers or recurring jobs (packages only register a `dpkg-trigger --no-await update-initramfs` postinst trigger) - Security has been kept in mind and common isolation/risk-mitigation patterns are in place: Firmware binaries are not executed in userspace; they are loaded into device hardware controllers/microcontrollers by kernel drivers via the kernel `request_firmware()` subsystem. Modern device controllers enforce cryptographic signature checks on the vendor firmware blobs before execution. - Packages do not open privileged ports (ports < 1024) - Packages do not expose any external endpoints - Packages do not contain extensions to security-sensitive software # -------- Deprecated-crypto - No deprecated cryptographic algorithms spotted in the packaging. [Quality assurance - function/usage] - The package works well right after install. When the system boots or hardware is plugged in, the kernel driver automatically probes the device and requests the required firmware blob from `/usr/lib/firmware`. [Quality assurance - maintenance] - The package is maintained well in Ubuntu and Upstream and does not have too many, long-term & critical, open bugs: - Ubuntu bug tracker: https://bugs.launchpad.net/ubuntu/+source/linux-firmware/+bugs - Upstream: https://gitlab.com/kernel-firmware/linux-firmware / [email protected] # -------- Exotic-hardware - The package does deal with exotic hardware we cannot support. The package delivers firmware for a broad variety of hardware, including specialized networking, switch fabrics, and enterprise controllers. The kernel team is not doing silicon validation due to lack of specific hardware. Bug reporters verify updates in `-proposed`/`-updates` on their specific hardware. [Quality assurance - testing] # -------- Build-time-tests - The package does not run a test at build time because the source packages only assemble and package Architecture: all binary firmware blobs into the Debian package structure. # -------- Autopkgtests - The package runs an autopkgtest, and is currently passing on all supported architectures. - The autopkgtest (`debian/tests/check-duplicates`) verifies that there are no duplicate firmware files (uncompressed vs. compressed `.zst`) and no file collisions between different packages providing firmware. # -------- Failing-tests - The package does not have failing autopkgtests right now. # -------- Untestable-packages - The package can not be well tested at build or autopkgtest time because executing and verifying firmware requires physical target silicon across thousands of different devices. - Due to the nature of firmware blobs, consequences of a regression that might slip through would include driver load failures or hardware malfunction for the specific device until an update or revert is issued. # -------- Micro-libraries - Packages do not ship libraries. [Quality assurance - packaging] # -------- Upstream-watch - Firmware packages are tightly coupled to new major kernel and Ubuntu releases. With every Ubuntu release, firmare packages are updated to the latest upstream kernel.org git commit at https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git. # -------- Maintainer - debian/control defines a correct Maintainer field: `Ubuntu Kernel Team <[email protected]>` # -------- Lintian - This package does not yield massive lintian Warnings or Errors. No Lintian overrides are present. # -------- Obsolete-deps - This package does not rely on obsolete or about to be demoted packages. - This package has no python2 or GTK2 dependencies. # -------- Debconf - The package will be installed by default, but does not ask debconf questions. # -------- Packaging-complexity - Source package builds are non-trivial. Source packages for all 19 firmware source packages are built from a single git repo at https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux-firmware. - Instructions and tooling to help with source package preparation are part of the git repo at `ubutnu/README.md` and `ubuntu/bin`, respectively. - Binary builds are easy. `debian/rules` uses standard `dh $@` with `debian/bin/install-firmware` handling file staging from `WHENCE`, symlink deduplication via `rdfind`, and compression via `zstd`. [UI standards] # -------- Translation - Application is not end-user facing (does not need translation). # -------- Desktop-file - End-user applications without desktop file, not needed because these packages ship binary firmware data files. [Dependencies] - All dependencies and recommends are in main: - Build-Depends: `debhelper-compat (= 13)`, `rdfind`, `rsync`, `zstd` (all in main). - Depends: `${misc:Depends}`, plus split firmware package dependencies on the metapackage (all in main). - Recommends: `firmware-sof-signed` (already in main). [Standards compliance] # -------- FHS-and-policy - This package correctly follows FHS and Debian Policy. All firmware files are installed under `/usr/lib/firmware`. # -------- License-longevity - Based on a reasonable review of information available at the time of this report, no expiry, time-limited grants, or obvious legal encumbrances have been identified that would be expected to affect promotion. - Licenses are documented in upstream `WHENCE` and machine-readable DEP-5 `debian/copyright` files across all packages (redistributable vendor firmware licenses, GPL-2+, MIT, etc.). [Maintenance/Owner] # -------- Owning-team - The owning team is and always has been Canonical's Kernel team. # -------- Static-builds - This does not use static builds. - This does not use vendored code (contains vendor-provided firmware blobs only). - This package is not rust based. # -------- Recent-build - The package has been built within the last 3 months in the archive. - Build links on Launchpad: - https://launchpad.net/ubuntu/+source/linux-firmware/20260915.git1522c78a.1ubuntu - https://launchpad.net/ubuntu/+source/linux-firmware-amd-graphics/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-amd-misc/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-broadcom-wireless/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-intel-graphics/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-intel-misc/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-intel-wireless/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-marvell-prestera/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-marvell-wireless/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-mediatek/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-mellanox-spectrum/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-misc/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-netronome/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-nvidia-graphics/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-qlogic/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-qualcomm-graphics/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-qualcomm-misc/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-qualcomm-wireless/20260915.git1522c78a-0ubuntu1 - https://launchpad.net/ubuntu/+source/linux-firmware-realtek/20260915.git1522c78a-0ubuntu1 # -------- Cross-team impact - All packages are already in main; this re-review establishes the formal review and audit trail without introducing functional changes or impacting other teams. - Some firmware files from kernel.org linux-firmware are deliberately excluded from this packageset because they are provided by other already-existing Debian packages: amd64-microcode, firmware-carl9170. [Background information] - The Package description explains the package well: "Firmware for Linux kernel drivers" - Upstream Name: linux-firmware - Link to upstream project: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git - Additional background: Historically, linux-firmware was a single gigantic package providing kernel firmware from kernel.org's linux-firmware git repository. The ever-growing size of the package caused issues with package releases and disk footprint, which eventually led to its breakup into smaller source and binary packages (LP: #1958518, LP: #2146533). Because the monolithic package was already in main, the split packages were placed directly into main without an explicit MIR bug. This re-review formalizes the audit trail per https://ubuntu.com/project/docs/MIR/mir-rereview/. ** Affects: linux-firmware (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167722 Title: [MIR] linux-firmware (and subpackages) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux-firmware/+bug/2167722/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
