Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH RFC 0/4] Add firmware signature file check | Date | Tue, 06 Nov 2012 00:01:52 +0000 |
| |
Takashi Iwai <tiwai@suse.de> wrote:
> this is a patch series to add the support for firmware signature > check. At this time, the kernel checks extra signature file (*.sig) > for each firmware, instead of embedded signature. > It's just a quick hack using the existing module signing mechanism, > thus provided only as a proof of concept for now.
There is another way to do this. If you look at the patches I proposed to wrap keys in PE binaries, you'll find that that can handle PKCS#7 format messages as that's what's in the sort of signed PE binary we're dealing with.
You could use this to put the firmware inside a signed-data PKCS#7 message.
David
| |