6 ms·

Interesting. But who is OpenDevicePartnership? Looking at the members on the repository this seems to be a Microsoft project?

• mariuolo 11mo ago
  Can one even do UEFI firmware projects without at least keeping Microsoft in the loop? As far as I remmeber, they control the issuance of keys for bootloaders. Or is this project supposed to do away with that?
  • Luker88 11mo ago
    Most of the top contributors are @microsoft.com so I would say it's a bit more than just "in the loop".
  • mjg59 11mo ago
    If you want to implement UEFI secure boot and verify existing signed objects then you need to incorporate Microsoft-issued certificates into your firmware, but that's very different from needing Microsoft to be in the loop - the certificates are public, you can download them and stick them in anything.
  • pjmlp 11mo ago
    Microsoft even has their own Rust project for UEFI. https://microsoft.github.io/mu/ https://microsoft.github.io/mu/
    • zang0 11mo ago
      Patina is a significant evolution of Mu. Mu has some bits & pieces of Rust code and EDKII is still the upstream for Mu. Patina is 100% Rust DXE Core implemented from spec.
      • CaptainOfCoit 11mo ago
        Are you somehow related to either projects? You seem to have a good understanding of both pieces :)
  • 7bit 11mo ago
    Already today you can remove the Microsoft keys from most mein board's UEFI and enroll your own. You can perfectly make your own UEFI implementation without Microsoft.
    • BonusPlay 11mo ago
      Except that many component manufacturers release their efi capsules signed with Microsoft PKI. So no, you can't fully remove them if you want to verify updates.
      • 7bit 11mo ago
        You're completely missing the point here.
      • zamadatix 11mo ago
        While "So no, you can't fully remove them if you want to verify updates" is a valid point, it's also an answer to a different question than the one asked.
  • p_l 11mo ago
    It's not that Microsoft controls the issuance, it's that their keys are pretty much guaranteed to be installed and thus getting your keys signed with their CA means you can use the pre-existing trust roots. They are also the one party that is forcing freedom-enabling but formal standard breaking ability of resetting Platform Key, because Microsoft actually documents (or used to) a process to deploy systems signed with your own key as part of the highest security deployment documentation for enterprise customers
• als0 11mo ago
  It's not open. It's not really about devices. And it's certainly not a partnership.
  • yencabulator 10mo ago
    Open as in "open for business".