bugGNU Boot - Bugs: bug #66137, nonfree software found in vboot...

 
 

bug #66137: nonfree software found in vboot tests in gnuboot-0.1-rc3_src.tar

Submitter:  GNUtoo <gnutoo>
Submitted:  Thu 29 Aug 2024 01:09:39 AM UTC
   
 
Category:  Freedom Priority:  9 - Immediate
Item Group:  None Status:  In Progress
Privacy:  Public Assigned to:  gnutoo
Open/Closed:  Open Computer:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 12 Oct 2024 02:38:36 PM UTC, comment #4: 

Hi, here's a new draft of the announce below.

Subject/Title: Nonfree software found gnuboot-0.1-*_src.tar again,
               many distros affected.

The GNU Boot project previously found nonfree microcode in
gnuboot-0.1-rc1_src.tar.xz.

This was announced in the "GNU Boot December 2023 News"
(https://lists.gnu.org/archive/html/gnuboot-announce/2023-12/msg00000.html). It
was fixed by re-making the affected tarball by hand with the nonfree
microcode removed and by contacting Canoeboot that had the same issue,
and by bug reporting and proposing patches to fix the issue in Guix as
well (they are still pending as we need to find a reviewer familiar
with Coreboot).

But recently we found a more problematic issue that also affects many
more distributions.

The Vboot source code used in Coreboot and in the vboot-utils package
available in many GNU/Linux distributions contains nonfree code in
their test data in tests/futility/data (nonfree microcode, nonfree
BIOS, Management Engine firmwares, etc).

So we had to re-release all the gnuboot-0.1-*_src.tar.xz tarballs we
made and we improved the process along the way (we now store the
changes in tag inside our git repository and simply regenerate the
tarballs with the build system that is available for a given tag).

We are also in the process of contacting distributions and/or
coordinating with them and we also need help as there are many
distributions to contact.

To do that we started contacting the free GNU/Linux distros
(https://www.gnu.org/distros/free-distros.html) that ship the vboot
source code. We also contacted Replicant that is a free Android distro
that also ships vboot source code.

We also started to contact common distros require certain repositories
to only have free software (so far we only contacted Debian as that
will help Trisquel fix the issue, but we also need to contact Fedora
for instance). Finding which distro to contact is made much easier
thanks to GNU's review of common distros policies
(https://www.gnu.org/distros/common-distros.html).

We coordinate that work on our bug report system at Savannah
(https://savannah.gnu.org/bugs/?group=gnuboot).

 GNUtoo <gnutoo>
Group administrator
Mon 23 Sep 2024 03:19:55 PM UTC, comment #3: 

Hi, here's a draft of the announce below.

Subject/Title: Nonfree software found gnuboot-0.1-*_src.tar again, many distros affected.

We previously found nonfree microcode in gnuboot-0.1-rc1_src.tar.xz.

This was announced in the "GNU Boot December 2023 News" (https://lists.gnu.org/archive/html/gnuboot-announce/2023-12/msg00000.html). It was fixed by re-making the affected tarball by hand with the nonfree microcode removed and by contacting Canoeboot that had the same issue, and by bugreporting and proposing patches to fix the issue in Guix as well (they are still pending as we need to find a reviewer familiar with Coreboot).

But recently we found a more problematic issue that also affects many more distributions.

The Vboot source code used in coreboot and in the vboot-utils package available in many GNU/Linux distributions contains nonfree code in their test data in tests/futility/data (nonfree microcode, nonfree BIOS, Management Engine firmwares, etc).

So we had to re-release all the gnuboot-0.1-*_src.tar.xz tarballs we made and we improved the process along the way.

We are also in the process of contacting distributions and/or coordinating with them and we might need help as there are many distributions to contact.

To do that we started contacting the free GNU/Linux distros (https://www.gnu.org/distros/free-distros.html) that ship the vboot source code. We also need to contact Replicant that is a free Android distro that also ships vboot source code.

We also started to contact common distros that have a policy to not redistribute nonfree software in certain repositories (so far we only contacted Debian as that will help Trisquel fix the issue, but we also need to contact Fedora for instance). Finding which distro to contact is made much easier thanks to GNU's review of common distros policies (https://www.gnu.org/distros/common-distros.html).

We coordinate that work on our bug report system at savannah (https://savannah.gnu.org/bugs/?group=gnuboot).

 GNUtoo <gnutoo>
Group administrator
Mon 23 Sep 2024 02:04:49 PM UTC, comment #2: 

I reopen because while the fix is in the source code and that I just pushed tags with fixes for the releases we already made, it's not over yet:
- The new tarballs need to be built (work in progress) and pushed the ftp.gnu.org and the old ones need to be deleted.
- We need to make an announce.

 GNUtoo <gnutoo>
Group administrator
Mon 09 Sep 2024 03:48:36 PM UTC, comment #1: 

A patch fixing this issue has been merged in main.

 Adrien Bourmault <neox>
Group administrator
Thu 29 Aug 2024 01:09:39 AM UTC, original submission:  

Hi,

The following files contain nonfree software:

coreboot/fam15h_udimm/3rdparty/vboot/tests/futility/data/bios_zgb_mp.bin
coreboot/fam15h_udimm/3rdparty/vboot/tests/futility/data/bios_mario_mp.bin
coreboot/default/3rdparty/intel-sec-tools/pkg/tools/tests/bios_acm2.bin
coreboot/default/3rdparty/intel-sec-tools/pkg/tools/tests/bios_acm.bin
coreboot/default/3rdparty/intel-sec-tools/testdata/fake_acm/biosacm_cbnt_fake.bin
coreboot/default/3rdparty/vboot/tests/futility/data/bios_zgb_mp.bin
coreboot/default/3rdparty/vboot/tests/futility/data/bios_mario_mp.bin
coreboot/fam15h_rdimm/3rdparty/vboot/tests/futility/data/bios_zgb_mp.bin
coreboot/fam15h_rdimm/3rdparty/vboot/tests/futility/data/bios_mario_mp.bin

For the background 'mario' is the first chromebook (CR-48) which use some vendor BIOS/UEFI and not Coreboot. The image probably contains nonfree BIOS code.

It also contains nonfree microcode updates. I verified that with microcode_extract.py inside bios_extract (http://review.coreboot.org/bios_extract). Guix has python2 available so it is possible to use that to run microcode_extract.py.

We also have a second issue: if we update Coreboot, we'll get more 'bios' images as vboot now include more chromebooks images in its tests.

The vboot-utils source code provided by Guix also them, so we need to contact them as well (and also ask them to review my patches for updating Coreboot which also remove nonfree software).

We also need to create a category for freedom bugs.

 GNUtoo <gnutoo>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by neox (Updated the item)
  • -email is unavailable- added by gnutoo (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 10 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-10-03 gnutoo Priority5 - Normal 9 - Immediate
    2024-09-23 gnutoo Open/ClosedClosed Open
    2024-09-23 gnutoo StatusFixed In Progress
    2024-09-09 neox StatusIn Progress Fixed
        Assigned tognuboot-maintainers gnutoo
        Open/ClosedOpen Closed
    2024-09-08 neox CategoryNone Freedom
        Severity3 - Normal 4 - Important
        StatusNone In Progress
        Assigned toNone gnuboot-maintainers

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-3b9d.
    Corresponding source code