Canonical, the company behind Ubuntu, has finally detailed its plan to deal with Secure Boot UEFI. Ubuntu has a significant user-base, and a majority of these users dual boot so we were looking forward to Ubuntu's stand on UEFI Secure Boot, after Fedora disclosed their plans.

Ubuntu Dropping Grub 2
In order to deal with UEFI, Ubuntu is dropping Grub 2 and plans to use Intel's efilinux loader with some modifications to add a relatively simple menu interface. This will enable users to switch between installed operating systems.

The reason Ubuntu developers give for dropping Grub 2 is:

The reason we've arrived at a different plan is that Ubuntu has a rather extensive base of preinstalled systems. Microsoft's Windows 8 logo requirements do say that there must be a way for users to disable secure boot or to install their own keys, and we strongly support this in our own firmware guidelines; but in the event that a manufacturer makes a mistake and delivers a locked-down system with a GRUB 2 image signed by the Ubuntu key, we have not been able to find legal guidance that we wouldn't then be required by the terms of the GPLv3 to disclose our private key in order that users can install a modified boot loader. At that point our certificates would of course be revoked and everyone would end up worse off.

Georg Greve, CEO, Kolab Systems AG, writes on Google+, "What I find interesting in this posting is that it shows GPLv3 works. Essentially it says "No we did not find a way to legally use GPLv3 software to lock down devices and are afraid that when vendors do that we will have to give users the key so they get back in control. I think we can call this a #win ;)"

Jan Wildeboer, Red Hat evangelist, responded and said, "It works so well that Canonical will drop Grub2 and thus separate itself even more from the rest of the Linux Ecosystem. Yep, a true #win -NOT."

Linux experts are in favour of dropping Grub 2 as Alan Cox says, "Dropping grub2 is a good thing. There are lots of sound technical reasons to drop grub2 irrespective of "secure" boot. Anyone who has tried configuring boot loading in Fedora 17 has already discovered what a complete heap it is - made worse I grant by the garbage layer Fedora has on top of it."

So, Ubuntu's decision to drop Grub 2 is a great thing.

Dependence On Microsoft Keys?
The problem is not with UEFI as Linux can handle that with ease, the problem starts with Microsoft's condition that OEMs should use UEFI Secure Boot instead of traditional BIOS. So, Linux player need to deal with this problem, while Fedora came out with its own solution, Canonical has taken a different route.

Ubuntu has generated an Ubuntu signing key for use with UEFI. The private half of this key will be stored securely on our Launchpad infrastructure, which will be responsible for signing boot loader images and distributing them in the Ubuntu archive.

Mark Shuttleworth wrote on the Ubuntu mailing list:

We've been working to provide an alternative to the Microsoft key, so that the entire free software ecosystem is not dependent on Microsoft's goodwill for access to modern PC hardware. We originally flagged the UEFI / SecureBoot transition as a major problem for free software, we lead the efforts to shape the specification in a more industry-friendly way, and we're pressing OEM partners for options that will be more broadly acceptable than Red Hat's approach.

SecureBoot retains flaws in its design that will ultimately mandate that Microsoft's key is on every PC (because of core UEFI driver signing). That, and the inability of SecureBoot to support multiple signatures on critical elements means that options are limited but we continue to seek a better result.

But if you want to boot Ubuntu CD on such hardware Ubuntu CD "will rely on a loader image signed by Microsoft's WinQual key, for much the same reasons as Fedora: it's a key that, realistically, more or less every off-the-shelf system is going to have, as it also signs things like option ROMs, and the UEFI specification only allows an image to be signed by a single key, write Ubuntu developers on mailing list.

Red Hat evangelist Jan Wildeboer writes on G+, "No matter how they spin it, Canonical/Ubuntu will also use a boot loader signed with the Microsoft key."

However Alan Cox seems to like Ubuntu's solution and says on G+, "The Ubuntu model seems far more realistic. Sign the boot loader, don't pretend the rest of the system is secure. If your bootloader includes a large penguin or Ubuntu logo users are going to notice if it gets re-purposed."

Follow Swapnil Bhartiya on Google+