[readme-burning-isos] Added additional link to www.fp.o/verify towards the beginning of the document
by Bryan Sutherland
commit f20d3592b2ef08bfddd795be588b11ebb7c573b0
Author: Bryan Sutherland <bryan.sutherland(a)gmail.com>
Date: Thu Mar 7 19:52:20 2013 -0700
Added additional link to www.fp.o/verify towards the beginning of the document
en-US/Validating.xml | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
---
diff --git a/en-US/Validating.xml b/en-US/Validating.xml
index f898320..0e80c36 100644
--- a/en-US/Validating.xml
+++ b/en-US/Validating.xml
@@ -20,6 +20,11 @@
The Fedora Project and Red Hat, Inc. have no control over external sites such as the ones listed in the sections below, or the programs they provide.
</para>
</important>
+ <section id="ect-Burning_ISO_images_to_disc-Validating_the_Files-Getting_the_CHECKSUM_Files">
+ <title>Getting the CHECKSUM Files</title>
+ <para>Before getting started, it's a good time to download the checksums from <ulink url="http://fedoraproject.org/en/verify"></ulink>. Click on the link that matches the ISO you have downloaded and keep it handy for the next steps.
+ </para>
+ </section>
<section id="sect-Burning_ISO_images_to_disc-Validating_the_Files-Validating_in_the_Windows_Graphical_Environment">
<title>Validating in the Windows Graphical Environment</title>
9 years, 3 months
[readme-burning-isos] Removed extra ">"
by Bryan Sutherland
commit 8e8e85174d98115d3acd14cc624ce8d6ac8363f8
Author: Bryan Sutherland <bryan.sutherland(a)gmail.com>
Date: Thu Mar 7 17:51:35 2013 -0700
Removed extra ">"
en-US/Downloading.xml | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
---
diff --git a/en-US/Downloading.xml b/en-US/Downloading.xml
index e9ef2be..ec000d2 100644
--- a/en-US/Downloading.xml
+++ b/en-US/Downloading.xml
@@ -4,6 +4,8 @@
<section id="sect-Burning_ISO_images_to_disc-Downloading">
<title>Downloading</title>
+ <section>
+ <title>Downloading an ISO Image</title>
<para>
Several download options for Fedora ISOs are available from
<ulink url="http://fedoraproject.org/get-fedora" />, including
@@ -13,10 +15,11 @@
official Fedora mirror, and torrents. Torrents download data
from multiple peers, but require special software (for example
<package>transmission</package> or <package>Ktorrent</package>).
- </para>>
+ </para>
<para>
The ISO files are large, so it might take a long time to download them, especially using a dial-up modem. If you have a slow connection to the Internet, consider using a download manager. Download managers typically enable you to pause and recommence the download at convenient times and to resume a download that was interrupted.
</para>
+ </section>
<section id="sect-Burning_ISO_images_to_disc-Downloading-Choosing_CD_or_DVD">
<title>Choosing CD or DVD</title>
<para>
9 years, 3 months
[readme-burning-isos] Revert "Update the revision history in prep for F18"
by Bryan Sutherland
commit 7c2769669aad0d63e446a612f3701f70f98d6df8
Author: Bryan Sutherland <bryan.sutherland(a)gmail.com>
Date: Thu Mar 7 17:43:40 2013 -0700
Revert "Update the revision history in prep for F18"
This reverts commit a863c7280febaba37f0d48359382668317b4ee59.
en-US/Revision_History.xml | 15 ---------------
1 files changed, 0 insertions(+), 15 deletions(-)
---
diff --git a/en-US/Revision_History.xml b/en-US/Revision_History.xml
index 5dd9790..19530e4 100644
--- a/en-US/Revision_History.xml
+++ b/en-US/Revision_History.xml
@@ -7,21 +7,6 @@
<simpara>
<revhistory>
<revision>
- <revnumber>18</revnumber>
- <date>Mon Dec 24 2012</date>
- <author>
- <firstname>Ben</firstname>
- <surname>Cotton</surname>
- <email>bcotton(a)fedoraproject.org</email>
- </author>
- <revdescription>
- <simplelist>
- <member>Update for Fedora 18</member>
- <member>Added content to clarify instructions.</member>
- </simplelist>
- </revdescription>
- </revision>
- <revision>
<revnumber>17</revnumber>
<date>Mon May 28 2012</date>
<author>
9 years, 3 months
[readme-burning-isos] Updates to Validating.xml to remove broken link to validation tool added new hashing tools
by Bryan Sutherland
commit c92f8ec5fbe56e944046ac6a974e6455faf42d17
Author: Bryan Sutherland <bryan.sutherland(a)gmail.com>
Date: Thu Mar 7 17:41:47 2013 -0700
Updates to Validating.xml to remove broken link to validation tool added new hashing tools
en-US/Downloading.xml | 28 ++++++++++++++--------------
en-US/Validating.xml | 17 ++++++++++-------
2 files changed, 24 insertions(+), 21 deletions(-)
---
diff --git a/en-US/Downloading.xml b/en-US/Downloading.xml
index b661236..e9ef2be 100644
--- a/en-US/Downloading.xml
+++ b/en-US/Downloading.xml
@@ -3,20 +3,20 @@
]>
<section id="sect-Burning_ISO_images_to_disc-Downloading">
-<title>Downloading</title>
- <para>
- Several download options for Fedora ISOs are available from
- <ulink url="http://fedoraproject.org/get-fedora" />, including
- "spins" (special versions targeted at specific audiences) and
- versions for different processor types. Multiple download
- methods are available, including direct download from an
- official Fedora mirror, and torrents. Torrents download data
- from multiple peers, but require special software (for example
- <package>transmission</package> or <package>Ktorrent</package>).
- </para>>
- <para>
- The ISO files are large, so it might take a long time to download them, especially using a dial-up modem. If you have a slow connection to the Internet, consider using a download manager. Download managers typically enable you to pause and recommence the download at convenient times and to resume a download that was interrupted.
- </para>
+ <title>Downloading</title>
+ <para>
+ Several download options for Fedora ISOs are available from
+ <ulink url="http://fedoraproject.org/get-fedora" />, including
+ "spins" (special versions targeted at specific audiences) and
+ versions for different processor types. Multiple download
+ methods are available, including direct download from an
+ official Fedora mirror, and torrents. Torrents download data
+ from multiple peers, but require special software (for example
+ <package>transmission</package> or <package>Ktorrent</package>).
+ </para>>
+ <para>
+ The ISO files are large, so it might take a long time to download them, especially using a dial-up modem. If you have a slow connection to the Internet, consider using a download manager. Download managers typically enable you to pause and recommence the download at convenient times and to resume a download that was interrupted.
+ </para>
<section id="sect-Burning_ISO_images_to_disc-Downloading-Choosing_CD_or_DVD">
<title>Choosing CD or DVD</title>
<para>
diff --git a/en-US/Validating.xml b/en-US/Validating.xml
index 64df140..f898320 100644
--- a/en-US/Validating.xml
+++ b/en-US/Validating.xml
@@ -29,17 +29,17 @@
<itemizedlist>
<listitem>
<para>
- HashTab: <ulink url="http://beeblebrox.org/"></ulink>
+ HashTab: <ulink url="http://implbits.com/HashTab/HashTabWindows.aspx"></ulink>
</para>
</listitem>
<listitem>
<para>
- Marxio File Checksum Verifier (FCV): <ulink url="http://www.marxio-tools.net/en/marxio-fcv.php"></ulink>
+ DivHasher: <ulink url="http://soft.mydiv.net/DivHasher.html"></ulink>
</para>
</listitem>
<listitem>
<para>
- DivHasher: <ulink url="http://soft.mydiv.net/DivHasher.html"></ulink>
+ MD5 GUI: <ulink url="http://www.toast442.org/md5/"></ulink>
</para>
</listitem>
</itemizedlist>
@@ -47,6 +47,9 @@
Follow the instructions provided to install the program. When you run the program, use the file selection tools provided to select your downloaded ISO image files. Then select the SHA256 algorithm for calculation, and run the tool. The program takes some time to complete, since it must read the entire ISO file.
</para>
<para>
+ If you are using HashTab, you will need to enable the SHA256 checksum option. In order to do this you will to open the File Properties window (right click --> File Hashes tab --> Settings), then select the SHA256 option. It is advisable to uncheck any preselected hash options as they will only slow down the hash calculations.
+ </para>
+ <para>
Open the file <filename>CHECKSUM</filename> with a text editor, such as <application>Notepad</application>, to display its contents. Make sure the hash displayed by the hash tool for <emphasis role="strong">each</emphasis> of the downloaded ISO files <emphasis role="strong">exactly</emphasis> matches the corresponding hash in the <filename>CHECKSUM</filename> file.
</para>
<para>
@@ -57,15 +60,15 @@
<section id="sect-Burning_ISO_images_to_disc-Validating_the_Files-Validating_at_the_Windows_Command_Prompt">
<title>Validating at the Windows Command Prompt</title>
<para>
- To check the files using the command prompt, download the program <filename>sha256sum.exe</filename> available from <ulink url="http://www.labtestproject.com/files/win/sha256sum/sha256sum.exe"></ulink>.
+ To check the files using the command prompt, download the program <filename>sha256sum.exe</filename> available from <ulink url="http://www.labtestproject.com/files/win/sha256sum/sha256sum.exe"></ulink>. If you have any problems accessing sha256sum.exe, you can try to grab <filename>md5sum.exe</filename> from <ulink url="http://etree.org/software.html"></ulink>. If you have downloaded <filename>md5sum.exe</filename> be sure to substitute for the correct tool below.
</para>
<para>
The <filename>sha256sum.exe</filename> program computes and displays hashes. To use it, save <filename>sha256sum.exe</filename> to the same directory as the ISO files. Select <guilabel>Run...</guilabel> from the Start menu and then enter <userinput>cmd</userinput> for the name of the program to start a <application>Command Prompt</application> window. Then change into the download directory. Run <command>sha256sum</command> with each ISO file like this:
</para>
-<screen>cd "C:\Documents and Settings\Owner\My Documents\My Downloads\Fedora"
-sha256sum.exe Fedora-&PRODVER;-i386-DVD.iso
-</screen>
+ <screen>cd "C:\Documents and Settings\Owner\My Documents\My Downloads\Fedora"
+ sha256sum.exe Fedora-&PRODVER;-i386-DVD.iso
+ </screen>
<para>
The program takes some time to complete, since it must read the entire ISO file.
</para>
9 years, 3 months
[technical-notes] Created tag 18.00
by Pete Travis
The unsigned tag '18.00' was created.
Tagger: Pete Travis <immanetize(a)fedoraproject.org>
Date: Mon Mar 4 23:08:30 2013 -0700
18.00
Changes:
John J. McDonough (29):
Initial commit
Initial F13 draft
Add .gitignore, get dir of extraneous README
Instructions for making a new version
Save Fedora 12 primary.sqlite and make note of that in README
More detail in README
Bring up to date with beta repo
Additional detail to build/README
Save F13 database
Save F14 database
Update for Fedora 15 pre-alpha
Save F15 prealpha database
Save F15 alpha and beta databases
Update for Fedora 15 Beta
Update Revision_History
Add publish/ and build/scratch/ to .gitignore
Fedora 15 release database
Fedora 16 alpha database
Fedora 16 Alpha
F16 groups with no changes removed
Add release database
Fedora 16 release
Remove draft tag
primary.sqlite for F17 alpha
Make f17 directory name consistent
Additional details in building tech notes added to README
Fedora 17 alpha
Update revision history
Add reminter that you need sqlite-devel to build/README
Pete Travis (17):
Cleared last releases' content from the en_US directory. As this content\ is non-incremental in nature, and effectively regenerated as a whole for each\ release, I've taken what WILL be reused and added it to the resources in the\ build directory.
Genericized Technical_Notes.xml for build dir
makeBeatScript now creates single-line includes.
Added some shell scripting to doit.sh : After building the xml files, it will check for empty files and remove them, insert section tags, populate a build directory for publican, and complete a test build..
Added primary.sqlite for f17 beta release
Merge branch 'master' of ssh://git.fedorahosted.org/git/docs/technical-notes
updating doit.sh
fixed scripts
First run of changes for F17
Added a note about the packages app to introduction, and added repo files from f17 final and f18 beta
Finishing up xml for f18 beta TNs
adding f18GA repodata
using &PRODVER; in Article_Info instead of hardcoded version number
not using &PRODVER; in Article_Info anymore; rudi said it probably breaks things
cleaning up for f18 GA
adding generated copy for F18GA, plus a few bonus fixes
f18ga xml added
Ruediger Landmann (2):
correct BZ product and (plausible) component
replace rogue entity
9 years, 3 months
[uefi-secure-boot-guide] master: Revert "Distinguish between our SB implementation's goals and its mechanism." (38da5b7)
by Eric Christensen
Repository : http://git.fedorahosted.org/git/?p=docs/uefi-secure-boot-guide.git
On branch : master
>---------------------------------------------------------------
commit 38da5b7757b0fd79be6890e9fad3a2e4958208e5
Author: Eric Christensen <sparks(a)redhat.com>
Date: Fri Mar 1 12:32:04 2013 -0500
Revert "Distinguish between our SB implementation's goals and its mechanism."
This reverts commit 98a35806489df4ad4ff27e3344881259d1813224.
>---------------------------------------------------------------
en-US/What_is_Secure_Boot.xml | 5 +----
1 files changed, 1 insertions(+), 4 deletions(-)
diff --git a/en-US/What_is_Secure_Boot.xml b/en-US/What_is_Secure_Boot.xml
index 2cb46da..86eedd1 100644
--- a/en-US/What_is_Secure_Boot.xml
+++ b/en-US/What_is_Secure_Boot.xml
@@ -428,10 +428,7 @@ AuthentiCode.
<title>&PRODUCT; Secure Boot</title>
<para>
The &PRODUCT; Secure Boot implementation has a single security
-objective: it prevents installation of a class of malware known as
-<firstterm>boot kits</firstterm> that infect the boot path of the
-machine. In order to do this, it prevents the execution of unsigned code,
-starting in the boot process and extending to the kernel and its modules.
+objective: it prevents the execution of unsigned code in kernel mode.
</para>
<para>
&PRODUCT; can boot on systems with Microsoft Secure Boot enabled,
9 years, 4 months
[uefi-secure-boot-guide] master: Fix a minor gramatical problem. (4d18f67)
by Eric Christensen
Repository : http://git.fedorahosted.org/git/?p=docs/uefi-secure-boot-guide.git
On branch : master
>---------------------------------------------------------------
commit 4d18f6767a9b73b9919c0f47fbddacf55ae61c8d
Author: Peter Jones <pjones(a)redhat.com>
Date: Wed Feb 27 15:12:15 2013 -0500
Fix a minor gramatical problem.
Subject and verb plurality should match.
Signed-off-by: Peter Jones <pjones(a)redhat.com>
Signed-off-by: Eric Christensen <sparks(a)redhat.com>
>---------------------------------------------------------------
en-US/What_is_Secure_Boot.xml | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/en-US/What_is_Secure_Boot.xml b/en-US/What_is_Secure_Boot.xml
index 9dfc8a3..2cb46da 100644
--- a/en-US/What_is_Secure_Boot.xml
+++ b/en-US/What_is_Secure_Boot.xml
@@ -482,8 +482,8 @@ see <xref linkend="sect-UEFI_Secure_Boot_Guide-What_is_Secure_Boot-Microsoft_Imp
into the kernel. Verification happens before loading kernel modules,
but it does not extend to user space applications. We can be certain
that no unsigned executable code is present until the initial ramdisk
-(initrd) is loaded. Since initrd contents is not cryptographically
-signed and contains executable code, booting a signed &PRODUCT; boot
+(initrd) is loaded. Since initrd contents are not cryptographically
+signed and contain executable code, booting a signed &PRODUCT; boot
loader can eventually lead to arbitrary effects.
</para>
<para>
9 years, 4 months
[uefi-secure-boot-guide] master: Don't say some platforms don't support SB correctly. (cd07ba2)
by Eric Christensen
Repository : http://git.fedorahosted.org/git/?p=docs/uefi-secure-boot-guide.git
On branch : master
>---------------------------------------------------------------
commit cd07ba242011f62d68e25917e1886d7d378392f1
Author: Peter Jones <pjones(a)redhat.com>
Date: Wed Feb 27 15:12:13 2013 -0500
Don't say some platforms don't support SB correctly.
We don't have any good examples of platforms implementing Secure Boot
incorrectly - the only existing one so far appears to be an accident, and
a fix is in progress. There's no user served by thinking this is a real
problem at this time.
Signed-off-by: Peter Jones <pjones(a)redhat.com>
Signed-off-by: Eric Christensen <sparks(a)redhat.com>
>---------------------------------------------------------------
en-US/What_is_Secure_Boot.xml | 7 -------
1 files changed, 0 insertions(+), 7 deletions(-)
diff --git a/en-US/What_is_Secure_Boot.xml b/en-US/What_is_Secure_Boot.xml
index 338ec4c..9dfc8a3 100644
--- a/en-US/What_is_Secure_Boot.xml
+++ b/en-US/What_is_Secure_Boot.xml
@@ -452,13 +452,6 @@ or enroll the &PRODUCT; certificate.
</para>
</warning>
<para>
-Some systems implement UEFI Secure Boot, but do not follow the
-Microsoft specification and use different certificates. On such
-systems, it is possible to boot &PRODUCT; if the &PRODUCT;
-UEFI Secure Boot certificates have been installed before. This needs
-a different first-stage boot loader.
-</para>
-<para>
&PRODUCT; boots on UEFI systems which do not support or have disabled
Secure Boot, too. This works with all UEFI boot loaders. These boot
loaders also support running in an environment which performs boot
9 years, 4 months
[uefi-secure-boot-guide] master: Provide a specific, itemized list of functionality we've disabled. (e223e06)
by Eric Christensen
Repository : http://git.fedorahosted.org/git/?p=docs/uefi-secure-boot-guide.git
On branch : master
>---------------------------------------------------------------
commit e223e06ed3b7ee2ac3d93ab7ab9d919985e301c8
Author: Peter Jones <pjones(a)redhat.com>
Date: Wed Feb 27 16:47:24 2013 -0500
Provide a specific, itemized list of functionality we've disabled.
Don't be vague about what's disabled and what might happen in some
distopic future. Provide a list of what's disabled, and a note about
systemtap to go with it (since it's not disabled, but does require some
workflow changes at this time.)
This needs complementary documentation of the tools it references,
including: mokutil, shim, MokManager, efikeygen.
Signed-off-by: Peter Jones <pjones(a)redhat.com>
Signed-off-by: Eric Christensen <sparks(a)redhat.com>
>---------------------------------------------------------------
en-US/What_is_Secure_Boot.xml | 67 ++++++++++++++++++++++++++++++++++++-----
1 files changed, 59 insertions(+), 8 deletions(-)
diff --git a/en-US/What_is_Secure_Boot.xml b/en-US/What_is_Secure_Boot.xml
index 0a65ad3..76d1a40 100644
--- a/en-US/What_is_Secure_Boot.xml
+++ b/en-US/What_is_Secure_Boot.xml
@@ -515,14 +515,65 @@ boot is not signed and could contain malicious code. The kernel
<section id="sect-UEFI_Secure_Boot_Guide-What_is_Secure_Boot-Risks-Forced_Removal_of_Features">
<title>Forced removal of features in Secure Boot mode</title>
<para>
- We currently use a blacklist approach to disable known-unsafe
-kernel functionality. If additional kernel functionality which is
-equivalent to arbitrary code execution in kernel mode becomes known, we
-will be forced to disable it. Customers relying on this functionality will
-be left with non-working hardware after a system upgrade, and perhaps with
-unbootable systems. Recovery would require manual steps per system, and
-physical presence may be required.
- </para>
+We currently use a blacklist approach to disable known-unsafe kernel
+functionality. In some cases, specific funcionality has been disabled. In
+most cases such functionality is obscure and seldom used. Currently, the
+list of restricted functionality includes:
+</para>
+<itemizedlist>
+<listitem>
+<para>
+modification of device memory address maps through "setpci", and writes to that
+memory from user space via sysfs
+</para>
+</listitem>
+<listitem>
+<para>
+hibernate (also known as <firstterm>suspend to disk</firstterm>)
+</para>
+</listitem>
+<listitem>
+<para>
+kexec and kdump (addressing this is a work in progress)
+</para>
+</listitem>
+<listitem>
+<para>
+writes to <firstterm>Machine Specific Registers</firstterm> writes via the
+"msr" kernel module.
+</para>
+</listitem>
+<listitem>
+<para>
+the acpi_rspd command line option, which is used to specify custom ACPI data
+</para>
+</listitem>
+<listitem>
+<para>
+io operations on /dev/kmem
+</para>
+</listitem>
+</itemizedlist>
+<para>
+In addition, use of systemtap modules is restricted to those modules which
+have been signed with an appropriate certificate. It is recommended that such
+a certificate be generated on-site, taking care to follow appropriate security
+practices for storage and use of a signing certificate. When using a site-local
+certificate, it can be enrolled in the machine's local database using the
+<firstterm>mokutil</firstterm> utility, which will then require a reboot before
+taking effect. Upon rebooting, <firstterm>shim</firstterm> will start
+<firstterm>MokManager</firstterm> to present you with an interface to enroll
+the certificate.
+</para>
+<warning>
+<para>
+It is critically important that proper precautions be employed when using
+site-local certificates, so that they cannot be found and used by an attacker
+to subvert module security. Treat such certificates as you would any critical
+secrets, and follow industry best practices for cryptographic keys and
+certificates.
+</para>
+</warning>
</section>
<section id="sect-UEFI_Secure_Boot_Guide-What_is_Secure_Boot-Risks-System_Transition">
<title>System Transitions out of Secure Boot</title>
9 years, 4 months
[uefi-secure-boot-guide] master: Secure Boot /is/ available on server hardware, just generally disabled. (9ef5bec)
by Eric Christensen
Repository : http://git.fedorahosted.org/git/?p=docs/uefi-secure-boot-guide.git
On branch : master
>---------------------------------------------------------------
commit 9ef5bec9e9ac8bea3d679fd758566173ef0609e4
Author: Peter Jones <pjones(a)redhat.com>
Date: Wed Feb 27 15:12:07 2013 -0500
Secure Boot /is/ available on server hardware, just generally disabled.
We shouldn't go saying it doesn't exist on servers or can't be used on
servers - right now there's simply no requirement to enable it on
servers.
Signed-off-by: Peter Jones <pjones(a)redhat.com>
Signed-off-by: Eric Christensen <sparks(a)redhat.com>
>---------------------------------------------------------------
en-US/What_is_Secure_Boot.xml | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/en-US/What_is_Secure_Boot.xml b/en-US/What_is_Secure_Boot.xml
index 64878b3..338ec4c 100644
--- a/en-US/What_is_Secure_Boot.xml
+++ b/en-US/What_is_Secure_Boot.xml
@@ -103,9 +103,9 @@ a modification has occurred, and simplifies their detection.
<note>
<title>Client Technology</title>
<para>
-UEFI Secure Boot is only available on some client devices, and it is explicitly
-labeled as client (as opposed to server) technology. It is expected that
-server technology will support Secure Boot at a future date.
+UEFI Secure Boot is currently only generally enabled on client devices, and
+is currently not recommended for deployment on server machines. It is
+expected that server technology will enable Secure Boot at a future date.
</para>
</note>
</section>
9 years, 4 months