Re: UEFI Secure Boot and Ubuntu - implementation

2012-06-25 Thread Jamie Strandboge
On Sat, 2012-06-23 at 04:21 +0100, Matthew Garrett wrote: Therefore, we will only be requiring authentication of boot loader binaries. Ubuntu will not require signed kernel images or kernel modules. How are you going to prevent your bootloader from being used to launch a trojaned

Re: UEFI Secure Boot and Ubuntu - implementation

2012-06-25 Thread Matthew Garrett
On Mon, Jun 25, 2012 at 03:01:50PM -0500, Jamie Strandboge wrote: At this point, because all the OS' stage 1 bootloaders (FLOSS and non-FLOSS) are signed by the same authority, we are all are affected by the others. It is clear that if there is a problem with DistroX's boot loader, malware

UEFI Secure Boot and Ubuntu - implementation

2012-06-25 Thread grarpamp
What specifically is Canonical/Ubuntu doing to contact the OEM (Quanta/Compal/etc) and Retail motherboard manufacturers (ASUS/BioStar/MSI/GigaByte/Intel/etc) in order to: - Query and ascertain their plans for UEFI Secure Boot implementation? - Ensure that motherboards purchased by Ubuntu users

Re: UEFI Secure Boot and Ubuntu - implementation

2012-06-25 Thread Jamie Strandboge
On Mon, 2012-06-25 at 21:09 +0100, Matthew Garrett wrote: On Mon, Jun 25, 2012 at 03:01:50PM -0500, Jamie Strandboge wrote: At this point, because all the OS' stage 1 bootloaders (FLOSS and non-FLOSS) are signed by the same authority, we are all are affected by the others. It is clear

Re: UEFI Secure Boot and Ubuntu - implementation

2012-06-25 Thread Matthew Garrett
On Mon, Jun 25, 2012 at 04:26:20PM -0500, Jamie Strandboge wrote: I was unaware that that Microsoft volunteered to maintain dbx. Where was this stated and how are they doing this exactly? This was discussed at the last plugfest. How does an individual/OS vendor go about providing the

Re: UEFI Secure Boot and Ubuntu - implementation

2012-06-25 Thread Philipp Kern
On Mon, Jun 25, 2012 at 10:41:17PM +0100, Matthew Garrett wrote: The benefits of signing purely a bootloader are minimal - bootloaders that load unsigned code will be perfectly willing to set up a secondary UEFI environment and then launch another bootloader that believes it's in a

Re: UEFI Secure Boot and Ubuntu - implementation

2012-06-25 Thread Jamie Strandboge
On Mon, 2012-06-25 at 22:41 +0100, Matthew Garrett wrote: On Mon, Jun 25, 2012 at 04:26:20PM -0500, Jamie Strandboge wrote: I was unaware that that Microsoft volunteered to maintain dbx. Where was this stated and how are they doing this exactly? This was discussed at the last plugfest.

Re: UEFI Secure Boot and Ubuntu - implementation

2012-06-25 Thread Matthew Garrett
On Mon, Jun 25, 2012 at 05:35:34PM -0500, Jamie Strandboge wrote: Understood (and what I was getting at with my question). This is interesting. I'd be curious what protections are in place to keep someone from blacklisting another vendor's binaries (presumably vendors could only blacklist

Re: New Ubuntu drivers autopkgtest case

2012-06-25 Thread Martin Pitt
Hello Ahmed, أحمد المحمودي [2012-06-25 4:33 +0200]: Is sl-modem-dkms added ? Done now in VCS, will upload within the hour. Martin -- Martin Pitt| http://www.piware.de Ubuntu Developer (www.ubuntu.com) | Debian Developer (www.debian.org) signature.asc

Quantal Alpha 2 milestone release prep

2012-06-25 Thread Kate Stewart
Dear Developers, We'll be starting to spin the images for Quantal Alpha 2 tonight. The experiment we used during Alpha 1 seems to have worked out fairly well :), so we'll be continuing with it in Alpha 2 until better tooling is available. For this milestone following rules will apply: