Theodore Ts'o <[email protected]> wrote: > Oh, so you are generating a one-time key for each kernel build,
Yes. > and then dropping the public key into a cert which is then signed by some > trusted CA system? No. We compile the public key into the vmlinux binary and leave it at that. Trying to automatically sign the key would expose the signing key through the buildfarm. David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
