Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers
by cesarb on Thursday January 25, 2024 @03:25PM
(#39134740)
> [...] any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work [...]
From what I understand, allowing the user to install their own trusted keys is enough; there's no need to allow users to sign with the "official" trusted key as long as that alternative exists.
I suspect that Microsoft's worry is that they don't control the firmware (the motherboard manufacturers do), and some UEFI firmware might be broken and not allow installing alternative trusted keys. I believe shim solves this by adding an intermediate layer which also allows the user to manually install their own trusted keys, even if the firmware doesn't.
From what I understand, allowing the user to install their own trusted keys is enough; there's no need to allow users to sign with the "official" trusted key as long as that alternative exists.
I suspect that Microsoft's worry is that they don't control the firmware (the motherboard manufacturers do), and some UEFI firmware might be broken and not allow installing alternative trusted keys. I believe shim solves this by adding an intermediate layer which also allows the user to manually install their own trusted keys, even if the firmware doesn't.