Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

deploy: Install detached signatures if present #2497

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

kjbracey
Copy link

@kjbracey kjbracey commented Dec 8, 2021

When installing a kernel, initramfs or device tree, also install a detached signature (.sig) file if present.

Intended to support GRUB GPG signature enforcement.

This does not currently lead to a fully-functional secure solution, due to GRUB's pubkey verifier also checking config files, but it allows the verify_detached command to work, and could be part of a future solution coordinating a lockdown verifier (to determine which file types must be verified) with a relaxed pubkey verifier that does not immediately reject unsigned files.

When installing a kernel, initramfs or device tree, also install a
detached signature (.sig) file if present.

Intended to support GRUB GPG signature enforcement.

This does not currently lead to a fully-functional secure solution, due
to GRUB's pubkey verifier also checking config files, but it allows the
`verify_detached` command to work, and could be part of a future
solution coordinating a lockdown verifier (to determine which file types
must be verified) with a relaxed pubkey verifier that does not immediately
reject unsigned files.
@openshift-ci
Copy link

openshift-ci bot commented Dec 8, 2021

Hi @kjbracey-arm. Thanks for your PR.

I'm waiting for a ostreedev member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@lucab
Copy link
Member

lucab commented Dec 8, 2021

/ok-to-test

@openshift-ci
Copy link

openshift-ci bot commented Jun 29, 2023

@kjbracey: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/images 984213f link true /test images
ci/prow/fcos-e2e 984213f link true /test fcos-e2e

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants