packaging: merge 2.51.6 changelog back to master #10650
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The main encryption key is high entropy 256bit already so there is no need to use a strong KDF on top of this. There was a PR already that switched this to 32MB but it turns out that 32KB is enough.
* osutil: rework TotalSystemMemory to TotalUsableMemory This commit renames total TotalSystemMemory to TotalUsableMemory and also changes the code to take the CmaTotal into account. This is the memory reserved by the "Contiguous Memory Allocator" and it is not usable for normal processes. This kind of memory is used e.g. by the framebuffer of the Raspberry Pi or by DSPs on certain boards. * secboot: use half the mem for KDF in AddRecoveryKey Instead of benchmarking the KDF parameters for the recovery key (which takes some time to run) we can also use defaults for the KDF parameters. The defaults suggested by Chris are "4 iterations" and half the usable memory. This commit implements the suggestions. * secboot: update KDF memory heuristic After discussing with Chris and Samuele we updated the KDF memory heuristic so that it takes more parameters in mind. It now considers the usable memory and substracts a hardcoded 384MB that is required to have a working system (a bit of a conservative estiamte) and then takes half of this for the KDF memory. * osutil,secboot: fix typos * secboot: add comment about minimum mem
Update changelog with the 2.51.6 changes.
Signed-off-by: Ian Johnson <ian.johnson@canonical.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To prevent the core snap edge build versions from getting out of sync.