Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

deploy: Install detached signatures if present #2497

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

deploy: Install detached signatures if present #2497

wants to merge 1 commit into from

Commits on Dec 8, 2021

  1. deploy: Install detached signatures if present 

    When installing a kernel, initramfs or device tree, also install a
detached signature (.sig) file if present.

Intended to support GRUB GPG signature enforcement.

This does not currently lead to a fully-functional secure solution, due
to GRUB's pubkey verifier also checking config files, but it allows the
`verify_detached` command to work, and could be part of a future
solution coordinating a lockdown verifier (to determine which file types
must be verified) with a relaxed pubkey verifier that does not immediately
reject unsigned files.
    @kjbracey
    kjbracey committed Dec 8, 2021
    Configuration menu
    Copy the full SHA
    984213f View commit details
    Browse the repository at this point in the history