bug#60109: gnome-boxes and distributions

bug#60109: gnome-boxes and distributions

[Denis 'GNUtoo' Carikli]

[-- Attachment #1: Type: text/plain, Size: 359 bytes --]

Hi,

I've installed gnome-boxes and I found out that it proposes to download
and run many distribution installers.

As it contains many non-FSDG compliant distributions, many of these
distributions probably contain nonfree firmwares at least.

Not all distributions are problematic though, as it contain some FSDG
compliant distributions.

Denis.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

bug#60109: gnome-boxes and distributions

[Denis 'GNUtoo' Carikli]

[-- Attachment #1: Type: text/plain, Size: 2804 bytes --]

Hi,

Here are some more information:

The Parabola's patch fox fixing that is probably this one:
https://git.parabola.nu/abslibre.git/tree/libre/libosinfo/libre.patch
This is because libosinfo is in the dependencies of gnome-boxes. I
didn't check beyound that.

To reproduce the bug one need to lauch gnome-box (probably with
virtualization services enabled).

Once installed and launched (and the first information wizard skipped)
we can click on the top-left "+" button.

We then have the choice between "Create virtual machine from file" and
"Download an operating system". 

It also shows "Featured Downloads" with distributions under it like Red
Hat entreprise Linux 9 Unknown x86_64, Fedora Workstation 36 x86_64
(live), etc and all these are known to contain nonfree firmwares. I'm
not sure if it shows this "Featured Downloads" all the time though.

If we click on Download an operating system, then we have a list of
distributions like Ubuntu, openSUSE etc which again are known to
include nonfree firmwares in their installers.

If we go down and click on the 3 vertical dot buttons, we then have a
more complete list which also includes FSDG compliant distributions
such as (complete list):
- PureOS x86_64 (Live) from Purism, SPC
- Guix latest x86_64 from Guix contributors
- PureOS 10 KDE x86_64 (Live) from Purism, SPC
- PureOS 10 GNOME x86_64 (Live) from Purism, SPC
- Trisquel 9 Sugar Toast x86_64 (live) from The Trisquel project
- Trisquel 9 x86_64 (live) from The Trisquel project
- Triskel 9 x86_64 (live) from The Trisquel project
- Trisquel 9 Mini x86_64 (live) from The Trisquel project
- Guix 1.3 x86_64 from Guix contributors
- Guix 1.3 i686 from Guix contributors
- Hypertalking 03 x86_64 (Live) from the Hyperbola project
- Hyperbola 03 x86_64 (Live) from the Hyperbola project

Then there are some distributions where I'm not completely sure of the
status:
- freenix x86_64 (DVD)(Live) from the Freenix project
  Here this is a distribution that applied for FSDG compliance but it
  was stuck in review for some reasons (probably either people waiting
  on each other, or the lack of time to review it properly from at
  least one of the sides)
- Debian: As far as I understand they include the nonfree firmwares by
  default nowadays in some situations, so it's probably easier to filter
  them out than check each installer / image for nonfree firmwares.
- Freedos: if I recall well that came with nonfree software but there
  is an ongoing effort to remove it, I just don't know the status. It
  probably still depend on nonfree compilers (under the openwatcom
  license) though so it probably has nonfree dependencies.

And as far as I know all the other either have at least nonfree
firmwares inside.

Denis.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

bug#60109: gnome-boxes and distributions

[Denis 'GNUtoo' Carikli]

[-- Attachment #1: Type: text/plain, Size: 956 bytes --]

On Fri, 16 Dec 2022 15:39:58 +0100
Denis 'GNUtoo' Carikli <kernel@cyberdimension.org> wrote:

> Hi,
> 
> Here are some more information:
> 
> The Parabola's patch fox fixing that is probably this one:
> https://git.parabola.nu/abslibre.git/tree/libre/libosinfo/libre.patch
> This is because libosinfo is in the dependencies of gnome-boxes. I
> didn't check beyound that.
I've looked in more details and it seems that the information is not in
libosinfo but in osinfo-db.

Apparently Parabola also patches virt-manager[1] probably to remove the
mention of non-FSDG distributions, so I'm not sure why Parabola didn't
patch osinfo-db directly instead.

Maybe it's to minimize the amount of rebuilds or something like that
(Parabola reuses packages from Arch Linux and removes/replace the ones
that are not FSDG compliant).

References:
-----------
[1]https://git.parabola.nu/abslibre.git/tree/libre/virt-manager/libre.patch

Denis.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]