About Ubuntu license

Ubuntu
1

Question 1
Assume our customer adopts the two business models below, with identical PCBA designs for both scenarios; only customized firmware is developed to meet the requirements of different brand owners. Is a single round of certification sufficient? In other words, which subject does the certification belong to and follow?
Model 1: Outsourced PCBA Manufacturing Model
Party A (PCBA design + firmware development + certification application) → Party B1/B2/B3… (pure PCBA contract manufacturing only) → Party C1/C2/C3… (complete machine assembly) → Party D1/D2/D3… (end product brand owners)
Model 2: In-house Board Production by the Solution Provider
Party A (board solution provision + hardware design + firmware development + certification application + in-house board manufacturing) → Party C1/C2/C3… (complete machine assembly) → Party D1/D2/D3… (end product brand owners)
Question 2
What is the specific authorization mechanism? (e.g., our company generates authorization keys that are flashed onto circuit boards by Party A or manufacturers in the Party B workflow, or keys are automatically generated via online connectivity)
Will devices without valid authorization function normally? In addition, how can Party A implement effective authorization control?

3

Hi @wr.zeng,

  1. Ubuntu certification is based on a combination of hardware and firmware. If there are two different customized firmware, then two certifications are required even though the hardware is the same.

  2. Authorization is implemented through Secure Boot. Party A controls the signing keys used to approve firmware. The verification keys are programmed into the device during manufacturing and are not generated online.

    Each time the device boots, it verifies that the firmware has been approved and signed by Party A. If the firmware is not signed with the correct key, the device will not boot normally.

    Because Party A exclusively controls the signing keys, only firmware authorized by Party A can run on the device, regardless of who manufactures the hardware.

Hope this clarifies. Thanks!

4

Thanks a lot