Messages in this thread | | | Subject | Re: [RFD] linux-firmware key arrangement for firmware signing | From | Mimi Zohar <> | Date | Tue, 26 May 2015 15:52:35 -0400 |
| |
On Tue, 2015-05-26 at 18:08 +0100, One Thousand Gnomes wrote:
> IMHO we want the supplier of a given firmware providing signatures on > the firmware git tree if this is done. A generic linux-firmware owned key > would be both a horrendously inviting attack target, and a single point of > failure. > > Git can already do all the needed commit signing bits unless I'm missing > something here ?
Nice! I haven't tried signing commits yet. Assuming the signatures can be extracted from git, the firmware blob git commit signature could be stored either as a security xattr or appended (eg. similar to kernel modules). The end system owner could then make the decision to load the associated public key or not.
Mimi
| |