Messages in this thread | | | From | David Howells <> | Subject | Re: sign-file and detached PKCS#7 firmware signatures | Date | Tue, 19 May 2015 19:47:52 +0100 |
| |
Luis R. Rodriguez <mcgrof@suse.com> wrote:
> I'll also mention: > > --- > The $DIGEST_ALGORITHM needs to be supported on the running kernel and > can differ from CONFIG_MODULE_SIG_HASH. > --- > > As I do no think that is quite obvious to a system integrator at first.
Actually, this isn't necessarily so for the firmware.
It *is* for the module signing, but you can always load the module to give you the digest algorithm (or public key algorithm) for the firmware.
Though you would still have to be careful with firmware loaded during the initramfs phase.
David
| |