Messages in this thread | | | From | David Howells <> | Subject | Re: sign-file and detached PKCS#7 firmware signatures | Date | Tue, 19 May 2015 21:29:09 +0100 |
| |
Luis R. Rodriguez <mcgrof@suse.com> wrote:
> > Though you would still have to be careful with firmware loaded during the > > initramfs phase. > > Make sense, how about: > > --- > The $DIGEST_ALGORITHM needs to be enabled as built-in (=y) or modular > (=m) in the running kernel and can differ from CONFIG_MODULE_SIG_HASH. > If you are enabling the $DIGEST_ALGORITHM as a module take care to > ensure that this module will also be present on the initramfs used as > some modules within the initramfs may need it if using the
Some firmware signatures, not modules.
> firmware_class APIs and firmware signing has been enabled. > ---
David
| |