Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers
by bee_rider on Thursday January 25, 2024 @02:35PM
(#39134050)
Maybe Microsoft just doesn’t want to sign a GPL bootloader and so they had their lawyers come up with nebulous concerns as a fig leaf. Microsoft <3 Open Source after all, can’t be seen as reluctant for business reasons.
Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers
by rany_ on Thursday January 25, 2024 @02:33PM
(#39134014)
To my knowledge, they aren't the ones signing the software. Microsoft runs a UEFI CA and just bless the developer's sub-CA. The developer is fully in control of their own CA and could sign whatever they want.
Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers
by AshamedCaptain on Thursday January 25, 2024 @02:49PM
(#39134226)
No. I don't know if Microsoft "partners" have some special privilege, but for 3rd parties Microsoft will _never_ sign your CA. They sign individual binaries.
v3 adds an additional requirement that if you mere-aggregate GPL software and other software, and put the aggregate into a consumer product, you can't disable the other software because the GPL software was modified. I don't believe this would apply in the situation that these shims are intended for - i.e. installing an OS onto a desktop machine, as those are supposed to allow you to enroll new Secure Boot keys anyway.
I also don't understand why a signature from Microsoft would actually trip any of the above-mentioned requirements. Microsoft is not distributing the software, they're just signing it - i.e. distributing a message saying "this shim with this hash can run". That's not a copyright violation, so the GPL doesn't come into play at all.
Perhaps there's something else Microsoft does with their signatures that might trip GPL...