Dear Maintainer,

The vboot source code has nonfree software in tests/futility/data.

If I take bios_link_mp.bin for instance, it's an image meant to be flashed on the boot flash
(on the first Chromebook Pixel).

So if I do ifdtool -x bios_link_mp.bin it extracts the Management Engine partition which
in flashregion_2_intel_me.bin which is not empty:

$ ifdtool -x bios_link_mp.bin
File bios_link_mp.bin is 8388608 bytes
  Flash Region 0 (Flash Descriptor): 00000000 - 00000fff
  Flash Region 1 (BIOS): 00200000 - 007fffff
  Flash Region 2 (Intel ME): 00001000 - 001fffff
  Flash Region 3 (GbE): 00fff000 - 00000fff (unused)
  Flash Region 4 (Platform Data): 00fff000 - 00000fff (unused)

The Management Engine firmware is then in flashregion_2_intel_me.bin

We can go furthurer with Coreboot source code to verify that it contains nonfree code:
$ git clone https://git.review.coreboot.org/p/coreboot.git
$ sudo apt install python3-minimal
$ python3 coreboot/util/me_cleaner/me_cleaner.py -c flashregion_2_intel_me.bin
ME/TXE image detected
Found FPT header at 0x10
Found 15 partition(s)
Found FTPR header: FTPR partition spans from 0x93000 to 0x108000
ME/TXE firmware version 8.0.20.1513
Public key match: Intel ME, firmware versions 7.x.x.x, 8.x.x.x
Checking the FTPR RSA signature... VALID

So here we see that the signature is valid, so it contains nonfree code signed by Intel.

ifdtool also extracts flashregion_1_bios.bin, and that kind of image should also have nonfree
binaries like microcode updates, MRC / FSP binaries, etc inside the "BIOS" partition though
I'm unsure how to verify that easily as I'm more used to more recent Coreboot images compatible
with cbfstool (here it uses fmap).

Though we can at least verify that it contains nonfree microcode quite easily:
$ git clone https://review.coreboot.org/p/bios_extract.git
$ sudo apt install guix
$ guix shell python2 -- python2 ./bios_extract/microcode_extract.py flashregion_1_bios.bin
[...]

And we then see nonfree microcode:
$ ls mcode_upd_0050*
mcode_upd_005004F8.bin  mcode_upd_005048F8.bin  mcode_upd_005090F8.bin  mcode_upd_0050D0F8.bin
mcode_upd_005028F8.bin  mcode_upd_00506CF8.bin  mcode_upd_0050A8F8.bin

There is more files than just bios_link_mp.bin in this directory, there are even kernel images
which lack complete and corresponding source code and that may or may not contain nonfree firmwares.

One option here could be to just remove all the files in that directory reguardless of the vboot
version. This way if upstream keeps adding more files, they will also not be shipped.

Now just removing the tests files might break compilation as the Makefile uses these files,
but it might be possible to just disable the tests using files that contain code by patching the
Makefile.

Also note that I didn't report the bug to upstream (maybe I should have) as they don't have the
same policy than Debian. Google may already have the right to redistribute these images
(I've no idea what kind of agreement they have with the providers of nonfree software like Intel)
as they already redistributed them inside the chromebook themselves, and if they didn't have the
right to redistribute them through some other means, they might not have added it in the first
place in their source code repository. Though it's also possible that it's also a bug upstream
but we have no way to know without bugreporting first.

I also started bugreporting that bug inside other distributions like Trisquel which is a downstream
of Debian. Since these utilities are widespread maybe we need to coordinate with all the distributions
that have policies that require not to ship nonfree software in certain repositories. Guix is also
affected (I didn't bugreport yet), Fedora might be affected as well, etc.

I'm also not sure if other distros that don't have rules like the DFSG, FSDG, etc would
be interested or not as I'm unsure if they have the right to redistribute these binaries
or not (it might depend on the jurisdiction they operate in) or if they would even care.

Hi,

I've also contacted Coreboot and at some point someone on their mailing
list took care of forwarding the bug to Google:

https://mail.coreboot.org/hyperkitty/list/coreboot@coreboot.org/thread/6JI7KTJ3QVK6Q5BLNWREX2IBVZP7GCLP/

So it might get fixed upstream at some point but it will probably take
some time before that happens because firmware images need to be re-made
without the nonfree software and signed with different keys.

Denis.

Hello,

Bug #1081675 in vboot-utils reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/vboot-utils/-/commit/7c8511267b675c82d08c57225da4975094c65f9c

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1081675

I am going to upload a NMU later to fix this. The changes are in git and also attached as a debdiff.

We believe that the bug you reported is fixed in the latest version of
vboot-utils, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1081675@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastian Germann <bage@debian.org> (supplier of updated vboot-utils package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 21 Nov 2024 13:20:44 +0100
Source: vboot-utils
Architecture: source
Version: 0~R106-15054.B+dfsg-0.1
Distribution: unstable
Urgency: medium
Maintainer: Sophie Brun <sophie@offensive-security.com>
Changed-By: Bastian Germann <bage@debian.org>
Closes: 1081675 1084077
Changes:
 vboot-utils (0~R106-15054.B+dfsg-0.1) unstable; urgency=medium
 .
   * Non-maintainer upload
   * Exclude non-free files (Closes: #1081675)
   * Upgrade to llvm-toolchain 19 (Closes: #1084077)
Checksums-Sha1:
 167afaec7beb684d526d6e66d4e2d24dbf1fa7b8 2270 vboot-utils_0~R106-15054.B+dfsg-0.1.dsc
 281a37412b50d09636fbd9ab860cefe24af57b4e 2447372 vboot-utils_0~R106-15054.B+dfsg.orig.tar.xz
 89692738380a3264e7d63f6fbae5bade0e820242 11592 vboot-utils_0~R106-15054.B+dfsg-0.1.debian.tar.xz
 1909d7ce902b661cd50ac1b94fa3deb86f4b69eb 6272 vboot-utils_0~R106-15054.B+dfsg-0.1_source.buildinfo
Checksums-Sha256:
 a91d447421762c36f78e8265b73e8a8e6f71a798002883b6a669995280db87f4 2270 vboot-utils_0~R106-15054.B+dfsg-0.1.dsc
 5cb02557adb12776fbe8c8ed0f0dee7304d489f0ed80028351f37195158423f0 2447372 vboot-utils_0~R106-15054.B+dfsg.orig.tar.xz
 556ee84a01f677b68cf78d7aadf4ade0537f9c2536d3163de3cbd1b54c578bc7 11592 vboot-utils_0~R106-15054.B+dfsg-0.1.debian.tar.xz
 39049f1b5ec06b36a248885b96631159bc50ed4f6b9d14c5569cc9d41a343bec 6272 vboot-utils_0~R106-15054.B+dfsg-0.1_source.buildinfo
Files:
 a17a153309258bb9c362f0fbe57f7844 2270 admin optional vboot-utils_0~R106-15054.B+dfsg-0.1.dsc
 cdd9372e50fd40518a7f958cad690b59 2447372 admin optional vboot-utils_0~R106-15054.B+dfsg.orig.tar.xz
 ead4fcfb53be18c598d990cce4158bda 11592 admin optional vboot-utils_0~R106-15054.B+dfsg-0.1.debian.tar.xz
 7b377b438f25de3d691180d2e3f0bb14 6272 admin optional vboot-utils_0~R106-15054.B+dfsg-0.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmc/TqYQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFAHdDACJHqUaDHcvZWkyJLimqLqFhmRp2Raia3fh
DfGWOnAwpvMgIKWNJjwZO+ps17vCg/YHYB1x04L5n6O1idhvmXu6x7ebxF3KnMUR
mQ97jDL8yTqDbfXqM14XzqENcl6/OkqN5J0o6En4zIR3MfFGk8KQd7j3Wo0Gz+HX
5B6KcZfTOZfLsO4ciWSxX8V67gJI1WNIWvLKHEO9ufkF7BKJPnnDwLECm9HfD855
NLez6z9nRE1iW2bXscP9XFjYGV4Tgho3rpuwY6buZdeAtu8iEaSrZojzqUypqC0b
X83ib9jMGl9cnCjqbxVOkyP2SxtrtsXoEyjJlHepOsSAbFmAiG+QrKzOi8L2tycf
ofF8Ke+r9sfHWKesDGrZeGkpvBFqUruOfz355j4UuaaXLwK/Ar294izlkRZfeA03
/ABx+eZ8KSDmPmUubyKi7pfhSsl/V4pMXrfPXe/GXPEKunQAqzvXKHiKtMUTDZSO
mE05ppFOrkcZcTz+a6ut5EgpXDw9aqY=
=dHzm
-----END PGP SIGNATURE-----

Hello Bastian,

Le 21/11/2024 à 14:22, Bastian Germann a écrit :

Thanks for the fixes and for the NMU

Sophie