a) doesn't require the vendor to do any work. The OEM can do exactly that,
pre-enroll the keys and use Canonical's images and not do any more work at all.
The only thing they have to do to comply with the GPLv3 is select hardware that
permits the user, not the OEM, to enroll their own keys or disable Secure
Boot (and of course include the tools Canonical provides for generating keys and
signing the bootloader). As I said, the GPLv3 requires that the OEM provide all
the tools to let the user modify the software, it doesn't obligate the OEM to
handhold the user through the process. It's up to the user to sign their own
modified bootloader and enroll the keys.
The only problem, as I noted, is
if the OEM elects to use a BIOS that doesn't permit users to modify the keys or
disable Secure Boot. That is the only time a signing key would have to be
disclosed to users. And there's no legitimate reason to select hardware that
prevents the user from exercising control over their own property. [ Reply to This | Parent | # ]
|