decoration decoration
Stories

GROKLAW
When you want to know more...
decoration
For layout only
Home
Archives
Site Map
Search
About Groklaw
Awards
Legal Research
Timelines
ApplevSamsung
ApplevSamsung p.2
ArchiveExplorer
Autozone
Bilski
Cases
Cast: Lawyers
Comes v. MS
Contracts/Documents
Courts
DRM
Gordon v MS
GPL
Grokdoc
HTML How To
IPI v RH
IV v. Google
Legal Docs
Lodsys
MS Litigations
MSvB&N
News Picks
Novell v. MS
Novell-MS Deal
ODF/OOXML
OOXML Appeals
OraclevGoogle
Patents
ProjectMonterey
Psystar
Quote Database
Red Hat v SCO
Salus Book
SCEA v Hotz
SCO Appeals
SCO Bankruptcy
SCO Financials
SCO Overview
SCO v IBM
SCO v Novell
SCO:Soup2Nuts
SCOsource
Sean Daly
Software Patents
Switch to Linux
Transcripts
Unix Books

Gear

Groklaw Gear

Click here to send an email to the editor of this weblog.


You won't find me on Facebook


Donate

Donate Paypal


No Legal Advice

The information on Groklaw is not intended to constitute legal advice. While Mark is a lawyer and he has asked other lawyers and law students to contribute articles, all of these articles are offered to help educate, not to provide specific legal advice. They are not your lawyers.

Here's Groklaw's comments policy.


What's New

STORIES
No new stories

COMMENTS last 48 hrs
No new comments


Sponsors

Hosting:
hosted by ibiblio

On servers donated to ibiblio by AMD.

Webmaster
Not at all the same | 474 comments | Create New Account
Comments belong to whoever posts them. Please notify us of inappropriate comments.
Not at all the same
Authored by: tknarr on Friday, July 06 2012 @ 12:56 PM EDT

The thing is, the bootloader as Canonical distributes it doesn't need to be signed. And if signed, it doesn't need to be signed by Canonical's key. That particular requirement only gets added when the OEM puts the hardware together. As long as Canonical also distributes all the tools needed to create signing keys, sign bootloaders and produce the public keys in a form which can be used for enrolling in the BIOS, Canonical's fulfilled their obligation to provide everything needed to load and run their software. If the OEM selects hardware which requires the bootloader to be signed by a particular key which can't be changed, that's something the OEM did, not Canonical. The obligation to produce the key would be on the OEM, not Canonical. The OEM would be in a bind if Canonical wouldn't give them their signing key, but Canonical hasn't done anything that'd oblige them to reveal that key.

Suppose I created a Linux distribution based on Debian but with APT modified to require packages be signed by Debian's current keys. Debian generates new keys. I'm definitely obligated to permit people who I distribute to to install updated versions of GPLv3'd software. Is Debian obligated to either disclose their signing keys (so people can sign new packages) or provide APT packages signed by the old keys (so people can replace my modified APT with Debian's stock one)? No. I'm the one on the hook. Note that Debian has to act for me to comply, I can't even release a new version of my modified APT without signing it with Debian's old key, but I've been stupid enough to put myself in this position without ensuring Debian's obliged to do what I need done. Debian's entitled to sit back and laugh while I get hammered.

(Yes, such a modified APT's possible. Install stock Debian distribution, including stock APT without the restriction. As the final step, install the unsigned APT package that includes binaries with the restriction.)

[ Reply to This | Parent | # ]

Groklaw © Copyright 2003-2013 Pamela Jones.
All trademarks and copyrights on this page are owned by their respective owners.
Comments are owned by the individual posters.

PJ's articles are licensed under a Creative Commons License. ( Details )