[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: UEFI Revocation List being distributed by Debian

Hi Mario,

On Thu, May 07, 2020 at 02:25:41AM +0000, Mario.Limonciello@dell.com wrote:
> Hello,

> Recently there has been a discussion within upstream fwupd to start
> including the UEFI dbx revocation list directly with the fwupd package. 
> During the code review for this as part of reviewing the terms included
> with it there are concerns if this would fit within the DFSG.  Would it be
> possible to request a review of these terms to determine if this is
> appropriate to distribute in Debian?

> https://uefi.org/revocationlistfile

> Furthermore, if it is not acceptable to distribute this raw data in
> Debian, one of the options being considered is to programmatically
> re-generate a list of invalid hashes but without the signatures in the
> original file.  Would that be acceptable to distribute in Debian instead?

First, the license is not an end-user license and if someone chooses to
agree to the license as part of downloading, this appears to only be binding
on the downloader; it is not a license that must be included in the
redistribution to users (as debian/copyright).

Second, the following URL is accessible without affirmatively agreeing to
the license.


Third, the contents of this file are a non-copyrightable list of statements
of mathematical facts.  Distribution of this file is not subject to
copyright law.

I don't think there is any issue with Debian distributing this file.

FWIW Ubuntu already distributes this file in the secureboot-db package.  I
do not think that Ubuntu would want to enable updates of the revocation list
via the fwupd package since revocations could in principle impact the
bootability of the system (if the dbx update included a hash of Ubuntu's
shim, or Ubuntu's signing key).  dbx updates should be carefully managed in
conjunction with updates to the bootloader itself, which the tighter
coupling of a directly-managed native package gives us.  I think similar
reasoning would apply for Debian.

Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                   https://www.debian.org/
slangasek@ubuntu.com                                     vorlon@debian.org

Attachment: signature.asc
Description: PGP signature

Reply to: