There is a dedicated page to all things VM firewall.

• BND1 - TP
• BND2 - TP, WF, DNS, URL, GP

• PAN-PA-4×0-BND-PRO - Professional - TP, WF, DNS, Adv URL
• PAN-PA-440-BND-ENT - Enterprise - TP, WF, DNS, Adv URL, IoT, SD-WAN, SaaS

(IoT will require the end user to have, or purchase, Cortex Data Lake)

(GlobalProtect subscription is not included in either bundle).

The official EULA from Palo Alto Networks is here.

With regards to sharing software update images, see the following

2. USE AND RESTRICTIONS > c. Use Restrictions > xiv.

Provide access to or otherwise make the Products or the functionality of the Products available to any third party through any means, including without limitation, by uploading the Software to a network or file-sharing service or through any hosting, managed services provider, service bureau or other type of service unless specifically permitted by the Published Specifications or agreed otherwise in a separate managed services agreement with Palo Alto Networks.

Palo Alto Networks can terminate your access to software updates, dynamic updates and subscription services if they catch you breaching the rules. Whether they would or not is a separate question/debate.

6. TERM; TERMINATION; AND EFFECT OF TERMINATION

This Agreement is effective until terminated or, as applicable, in accordance with the term of your Subscription. You may terminate this Agreement at any time by notifying Palo Alto Networks. Palo Alto Networks may terminate this Agreement at any time in the event you breach any material term and fail to cure such breach within thirty (30) days following notice. Upon termination, you shall immediately cease using the Product.