[Libosinfo] [v3 3/5] installer: API to query device driver signing requirement

[Zeeshan Ali (Khattak)]

On Mon, Feb 18, 2013 at 3:41 PM, Christophe Fergeau <cfergeau at redhat.com> wrote:
> On Sat, Feb 16, 2013 at 05:34:08AM +0200, Zeeshan Ali (Khattak) wrote:
>> On Fri, Feb 15, 2013 at 8:22 PM, Christophe Fergeau <cfergeau at redhat.com> wrote:
>> > On Fri, Feb 15, 2013 at 04:54:09AM +0200, Zeeshan Ali (Khattak) wrote:
>> >> From: "Zeeshan Ali (Khattak)" <zeeshanak at gnome.org>
>> >>
>> >> Some OS vendors recommend or require device drivers to be signed by them
>> >> before these device drivers could be installed on their OS. This
>> >> recommendation/requirement then also applies to the installer scripts of
>> >> that particular OS.
>> >
>> > Do we need to expose this to osinfo users as you added a magic workaround
>> > for the signing requirement ?
>>
>> I think we'll need this for win7 if we don't manage to find a similar
>> magic for it. Lets have the API in place already for that.
>
> Once this is in a release, we cannot get rid of this API if this ends up
> not being needed. Since I'm under the impression a libosinfo release is
> needed very soon, and that there will not be enough time to see if
> disabling/reenabling driver signing is doable in Win7 or not, I'd prefer we
> decide on adding this API or not after the win7 research has been done.

As long as the API is not confusing or bloated in any way, I wouldn't
care *too much* about it not being needed. As I said in another mail,
downstream and apps are allowed to extend our db so we can not just
decide our API only based on the needs of our own DB. i-e they can add
their own scripts for their own OSs.

Besides, if we are OK with adding APIs during API freeze and actual
drivers (the feature) during feature freeze, I don't really see see
the need to push any of my driver related work into this release.

> For what it's worth, the steps described at
> http://www.howinthetech.com/disabling-digital-driver-signing-in-windows-7/
> worked for me to disable driver signing when I tried on win7 64bits
> bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS
> bcdedit.exe -set TESTSIGNING ON
> I did not try to reenable driver signing after that though.

I have tried that. I still got the 'Do you trust this vendor' dialogs
and during install, drivers just didnt' get installed. I'll try again
of course with logging of .cmd file in hope of some clues.

-- 
Regards,

Zeeshan Ali (Khattak)
FSF member#5124