Re: [RFD] linux-firmware key arrangement for firmware signing

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Wed, May 20, 2015 at 07:46:13PM +0300, Petko Manolov wrote:
> On 15-05-20 17:24:46, One Thousand Gnomes wrote:
> > 
> > More to the point why do you want to sign firmware files ? Leaving aside the 
> > fact that someone will produce a device with GPLv3 firmware just to p*ss you 
> > off there's the rather more relevant fact that firmware for devices on a so 
> > called "trusted" platform already have signed firmware.
> 
> For "trusted" systems one would like to make sure everything that goes in has 
> known provenance.  Maybe this was the idea?

If so, then just do what people do today, verify their known valid disk
image before mounting it and then they know they can trust the data on
it to be use for whatever (including firmware.)  No kernel changes
needed, distro support is already there for this.

I too don't understand this need to sign something that you don't really
know what it is from some other company, just to send it to a separate
device that is going to do whatever it wants with it if it is signed or
not.

thanks,

greg k-h