Gentoo Archives: gentoo-dev

From: Rich Freeman <rich0@g.o>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] Killing UEFI Secure Boot
Date: Wed, 20 Jun 2012 00:24:30
Message-Id: CAGfcS_kY8S_M28jYbgeB-N+4gSD45OFJ74LhOOfUZSDt32T+yw@mail.gmail.com
In Reply to: [gentoo-dev] Killing UEFI Secure Boot by Richard Yao
1 On Tue, Jun 19, 2012 at 6:11 PM, Richard Yao <ryao@g.o> wrote:
2 > I know that the Core Boot project also tries to accomplish this, but their development process is slow and their approach seems to make the boot process more complicated than it needs to be. Since Secure Boot will force us to flash our BIOS chips (or stick to old hardware), I think it would be worthwhile to develop our own solution by extending genkernel. This should have the benefit of making our systems boot faster.
3
4 So, replacing a BIOS is a fairly tall order - I'm not convinced that
5 Core Boot is slow simply because they're doing it wrong. They're also
6 looking to add value (like booting a diskless server off of a random
7 website or whatever - not just simple disk/PXE like most BIOS). My
8 understanding is that clusters are one of their big use cases.
9
10 I also don't get the claim that we need to flash our BIOS chips to get
11 around secure boot. If you don't want to use secure boot just disable
12 it - it is no harder than changing your boot device order, system
13 time, or any of a myriad of other firmware settings. It gets more
14 complicated if you want to keep secure boot but boot your own OS,
15 since you have to manage the keys/signing/etc.
16
17 Nothing is keeping anybody from creating their own firmware. However,
18 I doubt we'll see 25 devs take this on as a full-time job, which is
19 probably what it would take to support the bazillions of boards out
20 there. Keep in mind that many motherboard vendors require signed
21 firmware so you'll need to find an exploit for every make/model out
22 there to even load your firmware. That seems a bit much compared to
23 just disabling secure boot...
24
25 Rich

Replies

Subject Author
Re: [gentoo-dev] Killing UEFI Secure Boot Richard Yao <ryao@g.o>