bugGNU Boot - Bugs: bug #66246, meta-bug for contacting distros...

 
 

bug #66246: meta-bug for contacting distros for nonfree software found in vboot-utils

Submitter:  GNUtoo <gnutoo>
Submitted:  Mon 23 Sep 2024 03:20:57 PM UTC
   
 
Category:  Freedom Priority:  5 - Normal
Item Group:  Upstream Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Computer:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Tue 29 Oct 2024 06:37:57 PM UTC, comment #11: 

The "real upstream" is ChromeOS' vboot, which coreboot imports through submodule.

vboot is tracking the issue on https://issuetracker.google.com/issues/374385985 and are looking into resolving it.

Seems like the decision now is to create mostly-empty images (with just enough bits set in the right places) and sign these with development keys to ensure that the tests do the right thing.

That should be a feasible route, but the devil is in the details: For example, if they use a throwaway key for verification, there might be yet another binary that can't be recreated from scratch. Much better (it's "nearly all 0"), but you're probably more sensitive about such concerns than they are.

As such it might make sense to track that issue website for items in the right column (in particular "CLs: Pending") so you can verify if the fix is according to your standards.

Patrick Georgi <oxygene>
Thu 17 Oct 2024 03:30:35 PM UTC, comment #10: 

Here's an updated table again.

It now contains all potential distros to contact from https://www.gnu.org/distros/common-distros.html as well as other affected distros.

If we want to contact Mandriva forks, it'd also be a good idea to update this common-distros.html page along the way.

Potential upstream:

| Coreboot   | Affected: bug #66325         |

Free GNU/Linux (self-hosted) distros:

| Dragora    | vboot not found              |
| Dynebolic  | ?                            |
| Guix       | Affected: bug #66181         |
| Hyperbola  | vboot not found              |
| Parabola   | Affected: bug #66191, #66249 |
| PureOS     | Affected: bug #66192         |
| Trisquel   | Affected: bug #66189         |
| Ututo XS   | ?                            |

Small GNU/Linux distros:

| LibreCMC   | vboot not found       |
| ProteanOS  | vboot not found       |

Free android distros:

| Replicant  | Affected: bug #66247 |

Other free boot distros:
| Canoeboot  | Affected: bug #66180 |

Distros that have a subset of their repositories without nonfree software:

| Debian       | Affected: bug #66190 |
| Fedora       | Affected: bug #66193 |
| Mageia       | Unknown policy       |
| OpenMandriva | Unknown policy       |
| openSUSE     | ?                    |

Downstreams of the above distros:

| Red Hat GNU/Linux         | ?                 |
| SUSE GNU/Linux Enterprise | ?                 |
| Ubuntu                    | Probably affected |

GNUtoo <gnutoo>
Group administrator
Thu 17 Oct 2024 03:25:32 PM UTC, comment #9: 

Hi, here's a new draft of the announce below.

Subject/Title: Nonfree software found gnuboot-0.1-*_src.tar again,
               many distros affected.

The GNU Boot project previously found nonfree microcode in
gnuboot-0.1-rc1_src.tar.xz.

This was announced in the "GNU Boot December 2023 News"
(https://lists.gnu.org/archive/html/gnuboot-announce/2023-12/msg00000.html). It
was fixed by re-making the affected tarball by hand with the nonfree
microcode removed and by contacting Canoeboot that had the same issue,
and by bug reporting and proposing patches to fix the issue in Guix as
well (they are still pending as we need to find a reviewer familiar
with Coreboot).

But recently we found a more problematic issue that also affects many
more distributions.

The vboot source code used in Coreboot and in the vboot-utils package
available in many GNU/Linux distributions contains nonfree code in
their test data in tests/futility/data (nonfree microcode, nonfree
BIOS, Management Engine firmwares, etc).

So we had to re-release all the gnuboot-0.1-*_src.tar.xz tarballs we
made and we improved the process along the way (we now store the
changes in tag inside our git repository and simply regenerate the
tarballs with the build system that is available for a given tag).

We are also in the process of contacting distributions and/or
coordinating with them and we also need help as there are many
distributions to contact.

To do that we started contacting the free GNU/Linux distros
(https://www.gnu.org/distros/free-distros.html) that ship the vboot
source code. We also contacted Replicant that is a free Android distro
that also ships vboot source code.

We also started to contact common distros require certain repositories
to only have free software (so far we only contacted Debian as that
will help Trisquel fix the issue, but we also need to contact Fedora
for instance). Finding which distro to contact is made much easier
thanks to GNU's review of common distros policies
(https://www.gnu.org/distros/common-distros.html).

We coordinate that work on our bug report system at Savannah,
especially in the bug #66246
(https://savannah.gnu.org/bugs/index.php?66246).

GNUtoo <gnutoo>
Group administrator
Sat 12 Oct 2024 02:40:43 PM UTC, comment #8: 

Added Coreboot as well as it might be a good idea to discuss with them as they might know people that can fix the issue upstream.

bug report: https://savannah.gnu.org/bugs/index.php?66325

GNUtoo <gnutoo>
Group administrator
Tue 24 Sep 2024 10:36:45 PM UTC, comment #7: 

In addition we also have the bug #66249 to track Parabola's vboot-utils status.

GNUtoo <gnutoo>
Group administrator
Mon 23 Sep 2024 04:12:24 PM UTC, comment #6: 

Here's an updated table. It now contains all potential distros to contact from https://www.gnu.org/distros/common-distros.html. If we want to contact Mandriva forks, it'd also be a good idea to update this common-distros.html page along the way.

Free GNU/Linux (self-hosted) distros:

| Dragora    | vboot not found       |
| Dynebolic  | ?                     |
| Guix       | Affected: bug #66181 |
| Hyperbola  | vboot not found       |
| Parabola   | Affected: bug #66191 |
| PureOS     | Affected: bug #66192 |
| Trisquel   | Affected: bug #66189 |
| Ututo XS   | ?                     |

Small GNU/Linux distros:

| LibreCMC   | vboot not found       |
| ProteanOS  | vboot not found       |

Free android distros:

| Replicant  | Affected: bug #66247 |

Other free boot distros:
| Canoeboot  | Affected: bug #66180 |

Distros that have a subset of their repositories without nonfree software:

| Debian       | Affected: bug #66190 |
| Fedora       | Affected: bug #66193 |
| Mageia       | Unknown policy       |
| OpenMandriva | Unknown policy       |
| openSUSE     | ?                    |

Downstreams of the above distros:

| Red Hat GNU/Linux         | ?                 |
| SUSE GNU/Linux Enterprise | ?                 |
| Ubuntu                    | Probably affected |

GNUtoo <gnutoo>
Group administrator
Mon 23 Sep 2024 03:54:19 PM UTC, comment #5: 

Red Hat GNU/Linux and SUSE GNU/Linux Enterprise may also need to be contacted as they may have separate nonfree repositories according to https://www.gnu.org/distros/common-distros.html. Though maybe if we notify only Fedora and/or OpenSuse some contributors there might also work for these commercial distributions and open a bug there as well.

GNUtoo <gnutoo>
Group administrator
Mon 23 Sep 2024 03:51:38 PM UTC, comment #4: 

We might need to contact openSUSE as well: "openSUSE offers a repository of nonfree software" (https://www.gnu.org/distros/common-distros.html). This probably means that they may have a repository of fully free software as well.

GNUtoo <gnutoo>
Group administrator
Mon 23 Sep 2024 03:50:20 PM UTC, comment #3: 

We might also need to contact mandriva and/or related distributions: "Mandriva does have a stated policy about what can be included in the main system" (https://www.gnu.org/distros/common-distros.html).

Also Canoeboot is the bug #66180 .

GNUtoo <gnutoo>
Group administrator
Mon 23 Sep 2024 03:39:46 PM UTC, comment #2: 

Guix is the bug #66181 but I don't know how to update the table above yet, I'll ask on IRC if it's possible to do.

GNUtoo <gnutoo>
Group administrator
Mon 23 Sep 2024 03:32:27 PM UTC, comment #1: 

Having individual bugs to track specific distros is convenient as that doesn't make the bug report huge, but then we cannot track which distros are not affected and the ones that still need to be checked.

Free GNU/Linux (self-hosted) distros:

| Dragora    | vboot not found      |
| Dynebolic  | ?                    |
| Guix       | Affected:            |
| Hyperbola  | vboot not found      |
| Parabola   | Affected: bug #66191 |
| PureOS     | Affected: bug #66192 |
| Trisquel   | Affected: bug #66189 |
| Ututo XS   | ?                    |

Small GNU/Linux distros:

| LibreCMC   | vboot not found      |
| ProteanOS  | vboot not found      |

Free android distros:

| Replicant  | Affected: bug #66247 |

Distros that have a subset of their repositories without nonfree software:

| Debian     | Affected: bug #66190 |
| Fedora     | Affected: bug #66193 |

GNUtoo <gnutoo>
Group administrator
Mon 23 Sep 2024 03:20:57 PM UTC, original submission:  


GNUtoo <gnutoo>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by oxygene (Posted a comment)
  • -email is unavailable- added by gnutoo (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.14-9aa3.
    Corresponding source code