On Fri, Mar 18, 2016 at 01:05:42PM +0100, Yamaban wrote:
On Fri, 18 Mar 2016 12:45, Andrei Borzenkov wrote:
On Fri, Mar 18, 2016 at 1:50 PM, Michael Chang wrote:
Hi All,
In the past we used to provide trustedgrub package in conjuction with legacy grub to support the TPM device and also the measure boot process. But after we migrated from grub to grub2, we dropped trustedgrub support from YaST because it's configuration and setup no longer compatible with grub2 that provides general and unified process for us to setup bootloader on all supported architectures.
Now that with TrustedGrub2 project it's back. :) And we can craft it with the same setup tools and configuration files from grub2 packages so that integration with existing system management tools like YaST become easy. The new package actually only contains it's i386-pc modules can be installed by grub2-install to your system plus some text (README, HOWTO etc) files as another package.
More information at : https://github.com/Sirrix-AG/TrustedGRUB2
It seems to be based still on beta2; any plans to rebase?
Do you propose to replace grub2-i386-pc package with trusted grub2?
That woud be stupid, period. And shortsighted, flamewar inductive.
Well, that's true, and referring to this opening (WIP) pull request bascailly says pretty much by itself .. https://github.com/Sirrix-AG/TrustedGRUB2/pull/14
Not everone using grub2-i386-pc wants the hassle of TPM related stuff.
Agreed, and as long as it's forked code stream from upstream grub2 we'd better treat it separate loader type, and by sharing the same utils to minimize the efforts in the integration.
For me TrustedGRUB2 becomes really interesting when it supports UEFI and x86_64 als well as GPT.
Yes, UEFI is not supported and they have been looking contributors. https://github.com/Sirrix-AG/TrustedGRUB2/issues/15 About GPT support, it's not the TrustedGrub2 but the bios, by which the bootcode gets loaded and should be measured. Probably also put the measured partition table in pcr logs.
That is where the (industrial) world of today is.
UEFI AND 64 Bit AND TPM is what is asked in the specs of many projects, not OR, and GPT is on the wishlist for many of them.
Although TCG has published their own UEFI protocol spec long ago. It's easily oversighted as not released as part of offical UEFI spec, don't know why ..
ATM this is a forced selling point of M$ Windows.
I heard about that, and they seems to cerify TPM 2.0 not TPM 1.2 support, which is missing support in most linux distributions afaics. I do not have the details for how they would certify it but wouldn't be surpised it's an unwelcome thing for Linux or the entire FOSS world.
TrustedGRUB2 1.4.0 is (atm) limited to leagacy BIOS, mbr, 32 bit. Still, it is a very good start, and I'll keep an eye on that.
Thanks for your summary. Thanks, Michael
- Yamaban. -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org
-- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org