RE: UEFI Revocation List being distributed by Debian

2020-05-08 Thread Mario.Limonciello
> -Original Message- > From: Steve Langasek > Sent: Friday, May 8, 2020 3:35 PM > To: Limonciello, Mario > Cc: debian-legal@lists.debian.org > Subject: Re: UEFI Revocation List being distributed by Debian > > Hi Mario, > > On Thu, May 07, 2020 at 02

Re: UEFI Revocation List being distributed by Debian

2020-05-08 Thread Steve Langasek
Hi Mario, On Thu, May 07, 2020 at 02:25:41AM +, mario.limoncie...@dell.com wrote: > Hello, > Recently there has been a discussion within upstream fwupd to start > including the UEFI dbx revocation list directly with the fwupd package. > During the code review for this as part of reviewing th

RE: UEFI Revocation List being distributed by Debian

2020-05-07 Thread Mario.Limonciello
. > -Original Message- > From: Florian Weimer > Sent: Thursday, May 7, 2020 1:43 AM > To: Paul Wise > Cc: Limonciello, Mario; debian-legal > Subject: Re: UEFI Revocation List being distributed by Debian > > > [EXTERNAL EMAIL] > > * Paul Wise: > > >

Re: UEFI Revocation List being distributed by Debian

2020-05-06 Thread Florian Weimer
* Paul Wise: > On Thu, 2020-05-07 at 07:26 +0200, Florian Weimer wrote: > >> It also has to be optional and disabled by default because a future >> dbx update may be specifically designed to stop Debian systems from >> booting. No Debian user will want to install such an update. > > Isn't the poi

Re: UEFI Revocation List being distributed by Debian

2020-05-06 Thread Mario.Limonciello
Paul, Appreciate your response. On May 7, 2020 00:26, Florian Weimer wrote: [EXTERNAL EMAIL] * Paul Wise: > This sort of data is liable to be out of date if included in the > source code of fwupd, I think this should be separate to fwupd in the > same way that tzdata is separate to glibc and

Re: UEFI Revocation List being distributed by Debian

2020-05-06 Thread Paul Wise
On Thu, 2020-05-07 at 07:26 +0200, Florian Weimer wrote: > It also has to be optional and disabled by default because a future > dbx update may be specifically designed to stop Debian systems from > booting. No Debian user will want to install such an update. Isn't the point of these updates to

Re: UEFI Revocation List being distributed by Debian

2020-05-06 Thread Florian Weimer
* Paul Wise: > This sort of data is liable to be out of date if included in the > source code of fwupd, I think this should be separate to fwupd in the > same way that tzdata is separate to glibc and DNSSEC root keys are > separate to DNS servers and the web PKI CAs should be separate to web > bro

Re: UEFI Revocation List being distributed by Debian

2020-05-06 Thread Paul Wise
On Thu, May 7, 2020 at 3:06 AM Mario Limonciello wrote: > there are concerns if this would fit within the DFSG > > https://uefi.org/revocationlistfile Since it does not include modification permission and several restrictions on redistribution, this license is unlikely to meet the DFSG requiremen

Re: UEFI Revocation List being distributed by Debian

2020-05-06 Thread Paul Wise
On Thu, May 7, 2020 at 3:06 AM Mario Limonciello wrote: > https://uefi.org/revocationlistfile For the benefit of the mailing list archive, here is a copy of that page in plain text form: UEFI Revocation List File ACCESS TO THE UEFI REVOCATION LIST FILE This file is used to update the Secure Bo

UEFI Revocation List being distributed by Debian

2020-05-06 Thread Mario.Limonciello
Hello, Recently there has been a discussion within upstream fwupd to start including the UEFI dbx revocation list directly with the fwupd package. During the code review for this as part of reviewing the terms included with it there are concerns if this would fit within the DFSG. Would it be