Re: [PATCH 1/3] scripts/make-release: Do not include the edk2 sources in the tarball anymore

[Thomas Huth <thuth@redhat.com>]

On 04/07/2022 11.14, Daniel P. Berrangé wrote:
> On Mon, Jul 04, 2022 at 08:26:34AM +0100, Stefan Hajnoczi wrote:
>> On Mon, 4 Jul 2022 at 07:45, Thomas Huth <thuth@redhat.com> wrote:
...
>>> +cat > sources.txt <<EOF
>>> +The edk2 sources can be downloaded from:
>>> +
>>> +https://github.com/tianocore/edk2/archive/${edk2rev}.tar.gz
>>
>> Please use QEMU's edk2 mirror:
>> https://gitlab.com/qemu-project/edk2
>>
>> QEMU mirrors all dependencies so that even if upstream projects go
>> offline we can still rebuild all of QEMU from source.
> 
> Note that the github/lab generated tarballs are not signed, while
> QEMU's release tarballs are gpg signed, so from that POV this would
> be a regression no matter which site we point to.

Maybe we should point to the edk2 release page instead? I.e.:

  https://github.com/tianocore/edk2/releases

Anyway, it's IMHO certainly not *our* job to provide signed edk2 sources here.

> Also it would need more guidance on what to actually do with the
> tarball, as if you merely unpack it into this dir, it won't work
> as it will be one level of dirs nesting too deep for QEMU's
> build scripts to work.

I could add some wording how to use the edk2-build.sh script with a 
downloaded edk2 tarball if that helps ... not sure whether it is really 
required, though, we also don't provide instruction for building any other 
firmware yet, as far as I know.

  Thomas