https://sourceware.org/bugzilla/show_bug.cgi?id=28204
Bug ID: 28204
Summary: extend webapi / verification with forthcoming
signed-contents archives
Product: elfutils
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: debuginfod
Assignee: unassigned at sourceware dot org
Reporter: fche at redhat dot com
CC: elfutils-devel at sourceware dot org
Target Milestone: ---
Efforts such as https://fedoraproject.org/wiki/Changes/Signed_RPM_Contents
might look stalled, but some distro builds are experimenting with this stuff
already. We may soon avail ourselves of RPMs that carry per-file IMA
signatures. If so, we should extract those signature bits and pass them back
to debuginfod clients. They may be able to offline verify the integrity of the
download, so as to not trust the debuginfod server.
--
You are receiving this mail because:
You are on the CC list for the bug.
