The thing is, the bootloader as Canonical distributes it doesn't need
to be signed. And if signed, it doesn't need to be signed by Canonical's key.
That particular requirement only gets added when the OEM puts the hardware
together. As long as Canonical also distributes all the tools needed to create
signing keys, sign bootloaders and produce the public keys in a form which can
be used for enrolling in the BIOS, Canonical's fulfilled their obligation to
provide everything needed to load and run their software. If the OEM selects
hardware which requires the bootloader to be signed by a particular key which
can't be changed, that's something the OEM did, not Canonical. The obligation to
produce the key would be on the OEM, not Canonical. The OEM would be in a bind
if Canonical wouldn't give them their signing key, but Canonical hasn't done
anything that'd oblige them to reveal that key.
Suppose I created a Linux
distribution based on Debian but with APT modified to require packages be signed
by Debian's current keys. Debian generates new keys. I'm definitely obligated to
permit people who I distribute to to install updated versions of GPLv3'd
software. Is Debian obligated to either disclose their signing keys (so people
can sign new packages) or provide APT packages signed by the old keys (so people
can replace my modified APT with Debian's stock one)? No. I'm the one on the
hook. Note that Debian has to act for me to comply, I can't even release a new
version of my modified APT without signing it with Debian's old key, but I've
been stupid enough to put myself in this position without ensuring Debian's
obliged to do what I need done. Debian's entitled to sit back and laugh while I
get hammered.
(Yes, such a modified APT's possible. Install stock Debian
distribution, including stock APT without the restriction. As the final step,
install the unsigned APT package that includes binaries with the
restriction.) [ Reply to This | Parent | # ]
|