Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4] | Date | Thu, 21 May 2015 14:59:12 +0100 |
| |
Andy Lutomirski <luto@amacapital.net> wrote:
> That being said, are you actually planning on implementing X.509 chain > validation correctly? ISTM you can't really do it usefully, as we > don't even know what time it is when we run this code.
We can't validate certificates based on time. We've been there, tried that and patched it out again. The problem is that we can't trust the system clock until we've done NTP - and possibly not even then. A dodgy or unset system clock can lead to the system not booting, even for installation.
David
| |