talos-petitboot/lib/security, branch v1.3.2Blackbird™ petitboot sourceshttps://git.raptorcs.com/git/talos-petitboot/atom?h=v1.3.22016-08-26T03:23:01+00:00Add encrypted file support2016-08-26T03:23:01+00:00tpearson@raptorengineering.comtpearson@raptorengineering.com2016-08-18T09:46:47+00:00urn:sha1:ccb478ac2e5b1e24ebb6af4130fdd37e1b36babb
In certain cases, such as network booting over an untrusted connection,
it may be useful to fully encrypt and sign the kernel files.
Enable fully encrypted boot using builtin keyring via the addition of
the string "ENCRYPTED" to the first line of the /etc/pb-lockdown file.
This disables detached (plaintext) signature verification.
Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com>
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Add support for GPG signature enforcement on booted2016-08-26T03:23:01+00:00tpearson@raptorengineering.comtpearson@raptorengineering.com2016-08-18T09:45:47+00:00urn:sha1:86c9d34380b0074dab1ba89a569a94280d6999c4
kernels and related blobs
This can be used to implement a form of organization-controlled secure boot,
whereby kernels may be loaded from a variety of sources but they will only
boot if a valid signature file is found for each component, and only if the
signature is listed in the /etc/pb-lockdown file.
Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com>
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
(Minor build fixes and gpgme.m4, comment on secure boot in gpg.c)