deploy: Install detached signatures if present #2497
Conversation
When installing a kernel, initramfs or device tree, also install a detached signature (.sig) file if present. Intended to support GRUB GPG signature enforcement. This does not currently lead to a fully-functional secure solution, due to GRUB's pubkey verifier also checking config files, but it allows the `verify_detached` command to work, and could be part of a future solution coordinating a lockdown verifier (to determine which file types must be verified) with a relaxed pubkey verifier that does not immediately reject unsigned files.
|
Hi @kjbracey-arm. Thanks for your PR. I'm waiting for a ostreedev member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/ok-to-test |
|
@kjbracey: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
When installing a kernel, initramfs or device tree, also install a detached signature (.sig) file if present.
Intended to support GRUB GPG signature enforcement.
This does not currently lead to a fully-functional secure solution, due to GRUB's pubkey verifier also checking config files, but it allows the
verify_detachedcommand to work, and could be part of a future solution coordinating a lockdown verifier (to determine which file types must be verified) with a relaxed pubkey verifier that does not immediately reject unsigned files.