Free Software Foundation recommendations for free operating system distributions considering Secure Boot
- Anmelden oder Registrieren um Kommentare zu schreiben
With comments on the approaches declared by Fedora and Ubuntu.
http://www.fsf.org/campaigns/secure-boot-vs-restricted-boot/whitepaper-web
Well isn't GRUB still used on systems that don't use secure boot but then switches to efilinux when secure boot is detected? Canonical's method just secures the bootloader and doesn't sign all the packages like the Red Hat method. Here is one place where I got the details:
http://m.theinquirer.net/inquirer/news/2186842/canonical-intels-efilinux-ubuntu-uefi-secure-boot
I also learned from https://lists.ubuntu.com/archives/ubuntu-devel/2012-June/035445.html that the GPLv3 is the big problem here with requriring their key to be made available and therefore it potentially being revoked by the certificate authority.
t3g said "the big problem here with requriring their key to be made available and therefore it potentially being revoked by the certificate authority."
That statement's made on a misunderstanding of GPLv3. If you read the FSF's statement Canonical/Ubuntu's position isn't based in reality, and they didn't even talk to the FSF beforehand -- which seems strange since the FSF wrote the GPL and hold the copyrights on GRUB2. Don't you think you'd *want* to talk to the the people that wrote the license and are in a position to enforce it before making a decision like that?
Say Canonical played along and used a GPLv3 bootloader with key and followed the advice of the FSF. The act of revoking the key by a 3rd party certificate authority means that it is up to the discretion of that authority if the methods of using the key follows their rules. If that company says to not share the key then what? Does that mean that Ubuntu and other GNU/Linux distros are at their mercy from now on?
Great link, lembas! Thanks :)
There was very nice information in the article about companies endorsed by the FSF that support free software.
I am a member!
I don't think those companies are endorsed by the FSF and I'm pretty sure there is a misunderstanding there as to what they are linking/pointing people to (it doesn't say they are recommending though, it says "work with"). Anyway- that said ThinkPenguin is in that list. The FSF explicitly has a program which will be endorsing certain products/companies. There are no currently endorsed products/companies.
(The reason I say that is because they are pointing people to companies distributing non-free software and hardware dependant on non-free software and even dependent on systems which prevent the replacement of things like wifi which don't work with free distributions; the laptops digitally restrict the cards which can be installed and thus they are certainly not compatible with free software; the graphics drivers for 3d acceleration are the same way- although there may be some limited support in another 5 years).
Apparently the new bootloader for Secure Boot is BSD based:
http://www.itworld.com/it-managementstrategy/284818/did-oem-influence-canonical-secure-boot-plan
Secure Boot will start GRUB 2 if it is signed. It is the approach followed by Fedora.
Replacing GRUB because it is GPLv3 does not make sense: the Tivoization clause of the GPLv3 would *not* force Canonical to release its private key. It would force the hardware manufacturer to allow the installation of a user-signed key and/or to allow to disable Secure Boot. Without that and with a BSD-license bootloader, the freedom to modify it is moot: the user is then unable to run the modified version.
This essential piece of information (about Canonical being wrong about the GPLv3) is, in the article you link, quite far away and hidden in a bunch of useless hypotheses about why Canonical, influenced by Dell, might have chosen to not contact the FSF. The FSF analysis and its recommendations (already referenced by lembas) make a far more interesting reading.
The big problem is the layman's interpretation of the GPLv3. Canonical, the FSF, and the free software development community understand what the license really means and software like GRUB can be used without giving away a secret key. The worry is there may be a loophole in GPLv3 that will force access to the key or a support person may have to get the key or disable secure boot. Microsoft does not want that scenario.
I'm guessing an employee at Dell or Microsoft or a lawyer went to Canonical and strongly advised against using GPLv3 code. Either they did not do their research or chose not to, but there is some figurehead putting up a roadblock for Canonical. Canonical is trying to improve the adoption of their OS and get it onto the hardware of big companies like Dell and will honestly do anything to keep their lights on. If that means playing by their rules, they will have to or else they lose a big contract and therefore have to reconsider their business model.
I'm thinking the bigger issue is with the FSF worrying that GRUB (for which they own the copyright) will go into obscurity if the biggest distros do not use it anymore. It could be a personal issue with the FSF even though efilinux is under a BSD license, which is much less restrictive than a GPL one.
Last I checked, the 2 and 3 clause BSD licenses are free software compatible and sometimes recommended by Stallman for certain scenarios. We should all be lucky that efilinux isn't closed source and is availble under a permissive license.
> The big problem is the layman's interpretation of the
> GPLv3. Canonical, the FSF, and the free software development community
> understand what the license really means and software like GRUB can be
> used without giving away a secret key. The worry is there may be a
> loophole in GPLv3 that will force access to the key or a support
> person may have to get the key or disable secure boot.
It's clear that the part of the GPLv3 requiring providing Installation
Information applies only to giving/selling physical products,
information how to disable Secure Boot is sufficient for that and
this part doesn't apply to Canonical unless they (not other vendors)
sell the machines.
I don't see any way how copyright would force sharing the key, they
could decide to stop selling the machines with infringing firmware
instead (as it was in some other GPL violation cases).
> Last I checked, the 2 and 3 clause BSD licenses are free software
> compatible and sometimes recommended by Stallman for certain
> scenarios. We should all be lucky that efilinux isn't closed source
> and is availble under a permissive license.
This isn't one of these scenarios. libvorbis being under a BSD license
leads to Vorbis being used in more software instead of patented codecs
which would have worse free software support in the US. The point here
is that we want to be able to install modified versions of the
bootloader or the kernel on our machines, being able to read the source
is not enough for us to control our computing.
SUSE details its Secure Boot plans
http://www.h-online.com/open/news/item/SUSE-details-its-Secure-Boot-plans-1664699.html
Digging up this thread just to write that t3g was definitely wrong and the rest of us right. Who said "as always"? :-)
- Anmelden oder Registrieren um Kommentare zu schreiben