Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #59487 > unrolled thread

Proposal: UEFI secure boot implementation sprint, early 2018

Back to article view | Back to linux.debian.kernel

Contents

  Proposal: UEFI secure boot implementation sprint, early 2018 Steve McIntyre <steve@einval.com> - 2017-11-24 16:40 +0100
    Re: Proposal: UEFI secure boot implementation sprint, early 2018 Chris Lamb <lamby@debian.org> - 2017-11-25 00:10 +0100
    Re: Proposal: UEFI secure boot implementation sprint, early 2018 Joerg Jaspert <joerg@debian.org> - 2017-11-27 16:20 +0100
      Re: Proposal: UEFI secure boot implementation sprint, early 2018 Helen Koike <helen.koike@collabora.com> - 2017-12-04 13:20 +0100
    Re: Proposal: UEFI secure boot implementation sprint, early 2018 Luke Faraone <lfaraone@debian.org> - 2017-12-04 19:40 +0100
    Re: Proposal: UEFI secure boot implementation sprint, early 2018 Ben Hutchings <ben@decadent.org.uk> - 2017-12-04 22:20 +0100
    Re: Proposal: UEFI secure boot implementation sprint, early 2018 Helen Koike <helen.koike@collabora.com> - 2018-01-12 20:00 +0100
      Re: Proposal: UEFI secure boot implementation sprint, early 2018 Chris Lamb <lamby@debian.org> - 2018-01-13 06:10 +0100
      Re: Proposal: UEFI secure boot implementation sprint, early 2018 Steve McIntyre <steve@einval.com> - 2018-01-15 18:50 +0100

#59487 — Proposal: UEFI secure boot implementation sprint, early 2018

[Multipart message — attachments visible in raw view] — view raw

[ Mailing various interested folks directly, and adding a CC to the
  relevant lists and the DPL. If you think I've missed people off,
  please let me know - my intention is not to slight anybody here. ]

Hi folks,

We've had more discussion over the last few days about how we
could/should implement UEFI Secure Boot infrastructure in Debian
[1-4]. I hope that we've got past the "should we do this or not"
diversions. It's time that we got together to finish the discussion
and get things up and running.

We've had several proposed routes to make the infrastructure work:

 * "byhand" or similar, driving things from ftpmaster getting the
   package maintainer do the work to combine unsigned binaries with
   sigs then upload again

 * "dh_sign", driving things from the maintainer scripts running on
   buildds, uploading automatically to the archive

 * a hybrid of these: driving things from buildd, but returning the
   sigs to the maintainer (somehow) to combine and upload

There are pros and cons and for all routes, but I believe that it
should be possible to work together to design something that will do
what we need without triggering too many objections or security fears.

Sprint proposal
===============

I propose that the interested people get together for a sprint *in
early 2018*. We should have the following people to *agree a design*
and *implement* that design:

 * (at least one) DSA member, able to do sysadmin-level things
   needed. Tollef and Julien have already been working in this area
   and understand what we're trying to do.

 * (at least one) ftpmaster, able to implement and/or review any
   needed changes in dak. Ansgar, Joerg and Luk have been involved in
   discussions already and understand the problem space.

 * (at least one) buildd software maintainer, able to implement and/or
   review any needed changes in the buildd stack.

 * maintainers of the packages that we expect to use the
   infrastructure (Linux kernel, grub, fwupdate), so we can work
   through example uploads and test things. Ben obviously covers the
   kernel side, and I have access for the grub and fwupdate packages.

 * Helen has been the primary developer working in this area so far,
   providing code for two of the proposals so far and helping to drive
   discussion. She should be there!

I expect that 3-4 days together should be enough for us to make this
work. To be honest, I'd hope that 2 day might be enough for what we
need, but 3-4 days should give us sufficient time to experiment and
play with things. We don't *have* to have everybody together
physically in one place, but experience tells me that would be by far
the most effective and efficient way to do things.

So... Please respond with:

=====================================================================
 a) your willingness to take part in this sprint
 b) your availability to travel for this sprint
 c) ideas on when/where we could meet up, if you have any
=====================================================================

and we'll get something sorted out. My own preferences would be to try
and arrange something in January (maybe) in Europe (as most of the
people are in Europe!), but those are not hard and fast. Maybe Germany
to make it easier for Joerg/Ansgar to join us?

If we don't have this done by the end of March, I don't think we'll
ever get Secure Boot in Debian.

@lamby: adding you in CC early for sprint budget approval. Clearer
details to follow!

[1] https://wiki.debian.org/SecureBoot#Wrap-up_of_the_discussions_so_far
[2] https://lists.debian.org/debian-efi/2017/10/msg00029.html
[3] https://lists.debian.org/debian-efi/2017/11/msg00007.html
[4] https://lists.debian.org/debian-efi/2017/11/msg00008.html

-- 
Steve McIntyre, Cambridge, UK.                                steve@einval.com
< Aardvark> I dislike C++ to start with. C++11 just seems to be
            handing rope-creating factories for users to hang multiple
            instances of themselves.

[toc] | [next] | [standalone]

#59492

Dear all,

> I propose that the interested people get together for a sprint *in
> early 2018*.

Thank you Steve for pushing this. :)

> @lamby: adding you in CC early for sprint budget approval. Clearer
> details to follow!

Of course. For now however, please consider that anything sensible will
be approved if that helps unblock anyone's diary, finances or generally
helps things get booked and confirmed sooner. :)

Naturally, let me know how else I can help.


Best wishes,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

[toc] | [prev] | [next] | [standalone]

#59497

On 14866 March 1977, Steve McIntyre wrote:

> =====================================================================
>  a) your willingness to take part in this sprint
>  b) your availability to travel for this sprint
>  c) ideas on when/where we could meet up, if you have any
> =====================================================================

a) yes
b) depends on when, but for family reasons, Mid Jan to Late March is a
   good timeframe.
c) Either LinuxHotel in Essen (need to ask if they can give us more than
   Fri afternoon to Sun, sometimes they can) or Fulda (easiest for me,
   also easy to reach by Train from Frankfurt Airport - ICE direct
   connection). Already had FTPMaster meetings in both locations.

-- 
bye, Joerg

[toc] | [prev] | [next] | [standalone]

#59551

On 11/27/2017 01:14 PM, Joerg Jaspert wrote:
> On 14866 March 1977, Steve McIntyre wrote:
> 
>> =====================================================================
>>   a) your willingness to take part in this sprint
>>   b) your availability to travel for this sprint
>>   c) ideas on when/where we could meet up, if you have any
>> =====================================================================
> 
> a) yes

a) yes [2]

> b) depends on when, but for family reasons, Mid Jan to Late March is a
>     good timeframe.

anytime is fine to me

> c) Either LinuxHotel in Essen (need to ask if they can give us more than
>     Fri afternoon to Sun, sometimes they can) or Fulda (easiest for me,
>     also easy to reach by Train from Frankfurt Airport - ICE direct
>     connection). Already had FTPMaster meetings in both locations.
> 

lgtm

Helen

[toc] | [prev] | [next] | [standalone]

#59554

On 24 November 2017 at 15:28, Steve McIntyre <steve@einval.com> wrote:
> =====================================================================
>  a) your willingness to take part in this sprint

Yes!

>  b) your availability to travel for this sprint

I'll be in Leipzeg for CCC from 26-30 December, and in Berlin through 4 January.

Happy to do something in the 1-4 January timeframe, or alternatively
some time in February or March.

>  c) ideas on when/where we could meet up, if you have any

I'd probably get in to Europe SFO→AMS, so Essen would be easier than Fulda :)

-- 

Luke Faraone;; Debian & Ubuntu Developer; Sugar Labs; MIT SIPB
lfaraone on irc.[freenode,oftc].net -- https://luke.wf/ohhello
PGP fprint: 8C82 3DED 10AA 8041 639E  1210 5ACE 8D6E 0C14 A470

[toc] | [prev] | [next] | [standalone]

#59556

[Multipart message — attachments visible in raw view] — view raw

On Fri, 2017-11-24 at 15:28 +0000, Steve McIntyre wrote:
[...]
> =====================================================================
>  a) your willingness to take part in this sprint

Yes.

>  b) your availability to travel for this sprint

I think I'm currently free aside from 2-4 February (FOSDEM) and 22-25
February (Snowcamp).

>  c) ideas on when/where we could meet up, if you have any
[...]

No suggestions of my own.  Essen looks easier than Fulda.

Ben.

-- 
Ben Hutchings
Lowery's Law:
        If it jams, force it. If it breaks, it needed replacing anyway.

[toc] | [prev] | [next] | [standalone]

#59964

Hello,

Linux Hotel is available on March 1-4, and we have setup a wiki to add 
all the information.

https://wiki.debian.org/Sprints/2018/SecureBootSprint

Could you please add yourselves in the list so we can better estimate 
the number of people going and the costs?

Thanks
Helen

[toc] | [prev] | [next] | [standalone]

#59969

Hi Helen et al.,

> Linux Hotel is available on March 1-4, and we have setup a wiki to add 
> all the information.
> 
> https://wiki.debian.org/Sprints/2018/SecureBootSprint

I've added myself for visibility and can currently attend if necessary
or requested, etc. etc.


Best wishes,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

[toc] | [prev] | [next] | [standalone]

#59999

On Fri, Jan 12, 2018 at 04:29:22PM -0200, Helen Koike wrote:
>
>Linux Hotel is available on March 1-4, and we have setup a wiki to add all
>the information.
>
>https://wiki.debian.org/Sprints/2018/SecureBootSprint
>
>Could you please add yourselves in the list so we can better estimate the
>number of people going and the costs?

Hey Helen! Thanks for picking this up. Apologies for me going dark
about this. I had a torrid time of things in December with a family
bereavement, and this was one of many things that I had to drop
temporarily.

Now it's time to get things going again. Helen has suggested March
1-4, but we're not 100% sure if that works for everyone who should be
at the sprint. Let's work out this out quickly with a Doodle
poll. Helen has created one at

  https://doodle.com/poll/p2sbgmvnd65vaup8

(I've added a link in the wiki page too). Please fill in there the
dates that you can make and we'll get organised.

Cheers,
-- 
Steve McIntyre, Cambridge, UK.                                steve@einval.com
Google-bait:       http://www.debian.org/CD/free-linux-cd
  Debian does NOT ship free CDs. Please do NOT contact the mailing
  lists asking us to send them to you.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web