From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.71) id 1W5zIX-0002Zb-Bi for mharc-grub-devel@gnu.org; Wed, 22 Jan 2014 10:00:57 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53648) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W5zIN-0002Yf-72 for grub-devel@gnu.org; Wed, 22 Jan 2014 10:00:55 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1W5zIE-0002nX-Pu for grub-devel@gnu.org; Wed, 22 Jan 2014 10:00:47 -0500 Received: from mail-ea0-x235.google.com ([2a00:1450:4013:c01::235]:49937) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W5zIE-0002nH-Do for grub-devel@gnu.org; Wed, 22 Jan 2014 10:00:38 -0500 Received: by mail-ea0-f181.google.com with SMTP id m10so4660851eaj.26 for ; Wed, 22 Jan 2014 07:00:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type; bh=xkUV4xE1uMkWAaqoJ23T1DlxyNFlER9Czr+rvMxRVh0=; b=pc9lvO55HHkXAO0a6dy2Zdlgyms5DVMi2lAGRv5I9iWe5G9Rdw3uo8SnfYR4AW+O1F Doubr0HyyKiV9e1iC2/PWFFN59Fv2m7XiWldG3sU5/DtQs8g5Gf/ctD7F4u480RTwAAC Ft8kw7nyV9S2q371+7NYLB6kDNWCV/jSYOJr4anVj0uQ3jTb7IY43GTDrlsdyuZqEalt 9qAttQzPCpeeQmocAq05BSXG/mfYaI5Ahx01Qws22qKieSVP4wA7tPWTfXVJk0kp30vE 7lBvkPoZYG3/FqlEWHOcKejKQP3URra8KMjjJudRlzrO1C+ic1XL5AnJsKyLGz+LkeAH DP8Q== X-Received: by 10.15.31.196 with SMTP id y44mr428513eeu.96.1390402837493; Wed, 22 Jan 2014 07:00:37 -0800 (PST) Received: from [192.168.1.16] (85-188.196-178.cust.bluewin.ch. [178.196.188.85]) by mx.google.com with ESMTPSA id k41sm28023791eey.0.2014.01.22.07.00.36 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 22 Jan 2014 07:00:36 -0800 (PST) Message-ID: <52DFDD13.1@gmail.com> Date: Wed, 22 Jan 2014 16:00:35 +0100 From: =?UTF-8?B?VmxhZGltaXIgJ8+GLWNvZGVyL3BoY29kZXInIFNlcmJpbmVua28=?= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Icedove/24.2.0 MIME-Version: 1.0 To: The development of GNU GRUB Subject: Re: [PATCH] Add linuxefi module References: <1390260488-18091-1-git-send-email-lkundrak@v3.sk> <20140121202447.66091674@opensuse.site> <52DEA04F.6030002@gmail.com> <20140121232957.GA24596@riva.ucam.org> In-Reply-To: <20140121232957.GA24596@riva.ucam.org> X-Enigmail-Version: 1.6 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="c9UqmUu5RvqsKCo83TNGFqGqXpAHSEAsK" X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-Received-From: 2a00:1450:4013:c01::235 X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: The development of GNU GRUB List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jan 2014 15:00:55 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --c9UqmUu5RvqsKCo83TNGFqGqXpAHSEAsK Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 22.01.2014 00:29, Colin Watson wrote: > On Tue, Jan 21, 2014 at 05:29:03PM +0100, Vladimir '=CF=86-coder/phcode= r' Serbinenko wrote: >> This part is from RH "Secureboot" patch. Few things are right about th= at >> patch. Whatever signature verifications would need to be integrated wi= th >> signatures framework (I have some scratch in phcoder/file_types) >=20 > The RH SB patch is not ideal from a pure GRUB point of view. But > realistically, in order to actually be useful in the (unfortunate) SB > ecosystem that exists today where Microsoft is the effective root of > trust on most mass-market hardware, we need to have a non-GPLv3 > component that is what the firmware actually loads directly, it needs t= o > be able to do signature checking in order to chain to GRUB, and it's > unlikely to be helpful for the signature checking to be implemented in > two places - so the scheme where GRUB calls out to shim seems to be an > uncomfortable necessity there. >=20 Distros start shipping signed kernels with signing in EFI way, including Ubuntu. Similar proposal to add GnuPG signatures was met with scepticism (if I remember correctly, including from you). On coreboot systems it can be interesting to verify that kernel came from Ubuntu and the only current way to do so is EFI-style signature. > I have no objection to there being some more native mechanism in GRUB > that works when users take control of their own trust chain; that seems= > entirely consistent with the FSF's goals regarding UEFI. But I'm havin= g > trouble seeing how we could make use of it effectively in order to > bootstrap free operating systems on firmware that only has the Microsof= t > keys in place, which I think is just as important now as the ability to= > run GNU software on proprietary Unixes was back in the 1980s. >=20 > (Unless, of course, you mean that there ought to be something integrate= d > into GRUB's signatures framework that would let it optionally call out > to shim; that would be an interesting possibility.) >=20 --c9UqmUu5RvqsKCo83TNGFqGqXpAHSEAsK Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Icedove - http://www.enigmail.net/ iF4EAREKAAYFAlLf3RMACgkQmBXlbbo5nOst9wEArl8D+JPlt+G6k3qfqugK2Y7n 9g5gw+ubm9kbcdzqVAgA/3w/tKdKJ+eQFx1BH1BaW/9mCH3sdJF9tD2qqyOYFzJk =A9L9 -----END PGP SIGNATURE----- --c9UqmUu5RvqsKCo83TNGFqGqXpAHSEAsK--