453

Ventoy source code contains some unknown BLOBs, still no word on the issue from the dev after months (github.com)

submitted 1 month ago by SatyrSack@lemmy.one to c/opensource@lemmy.ml

132 comments fedilink hide all child comments

I had no idea this issue had been identified. While I find this tool very useful, the project is seeming rather questionable to me now.

you are viewing a single comment's thread
view the rest of the comments

[-] n2burns@lemmy.ca 82 points 1 month ago

I too wish the developer would respond, but I don't think this is the catastrophe people are making it out to be. One comment seems to explain why these binaries are included:

Because ventoy supports shim, and by extension secure boot, these files needs to come from a signed Linux distro. In this case they are taken from Fedora releases, and OpenSUSE apparently, as they publish shim binaries and grub binaries signed by their certificate.