3 ms·
> I'm curious how shim avoids the issue Microsoft is concerned about. IIRC, shim has a way to allow someone physically present to add additional keys which wil
by cesarb 3y ago
> I'm curious how shim avoids the issue Microsoft is concerned about.
IIRC, shim has a way to allow someone physically present to add additional keys which will also by trusted by that instance of shim. That's enough to satisfy the GPL requirements.
- Arnavion 3y agoYes, that is how the MOK enrolment process works. The distro drops its MOK (the one it used to sign the kernel into the distro kernel package) into the ESP. On next boot shim notices the new key and asks the user if they want to enroll it. Similarly if the user wants to enroll additional keys for kernel modules they built themselves or got from somewhere else, they can do the same process.