Messages in this thread | | | From | David Howells <> | Subject | Re: Should we automatically generate a module signing key at all? | Date | Tue, 19 May 2015 19:10:08 +0100 |
| |
Theodore Ts'o <tytso@mit.edu> wrote:
> Oh, so you are generating a one-time key for each kernel build,
Yes.
> and then dropping the public key into a cert which is then signed by some > trusted CA system?
No. We compile the public key into the vmlinux binary and leave it at that. Trying to automatically sign the key would expose the signing key through the buildfarm.
David
| |