lkml.org 
[lkml]   [2015]   [May]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Should we automatically generate a module signing key at all?
Date
Theodore Ts'o <tytso@mit.edu> wrote:

> Oh, so you are generating a one-time key for each kernel build,

Yes.

> and then dropping the public key into a cert which is then signed by some
> trusted CA system?

No. We compile the public key into the vmlinux binary and leave it at that.
Trying to automatically sign the key would expose the signing key through the
buildfarm.

David


\
 
 \ /
  Last update: 2015-05-19 20:21    [W:0.064 / U:0.292 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site