Nico Kadel-Garcia wrote:
On Sun, Dec 26, 2021 at 1:10 AM Dan Čermák
<dan.cermak(a)cgc-instruments.com> wrote:
>
> Ben Cotton <bcotton(a)redhat.com> writes:
>
> *snip*
>
> > == Upgrade/compatibility impact ==
> > The user should ensure that software (not updated) from the old
> > distribution is packaged and the package header is signed, or he
> > should create and sign a custom digest list for the software he wishes
> > to use after the upgrade.
>
> Uhm, so locally/manually installed software (i.e. not signed by Fedora's
> signkeys) will silently break when switching to F36? How about 3rd party
> repositories?
It wouldn't be the first time software has been deliberately broken by
well-intended kernel security changes. Remember when systemd decided
to cancel all backgrounded processes belong to a user when they logged
out, breaking "screen" and "tux", with no record of killing the jobs
whatsover? Fortunately, people screamed pretty hard about that one.
But being allowed to run custom or self-developed software is a core feature
of Free Software. If that stops working in the name of "security", Fedora is
no better than iOS (where Apple also claims the restrictions are for
"security" purposes), and becomes entirely useless for me.
And the whole concept of "remote attestation" is inherently a Treacherous
Computing (so-called "Trusted Computing") (mis)feature and as such entirely
unacceptable to begin with.
This Change is absolutely unacceptable. If implemented as proposed (enabled
by default), I will be forced to leave for another distribution (as a user,
which however also implies that I will have to orphan all my packages).
Kevin Kofler