Re: [Ksummit-discuss] [TOPIC] Secure/verified boot and roots of trust

[Andy Lutomirski <luto@amacapital.net>]

On Wed, Aug 3, 2016 at 4:01 PM, Ben Hutchings <ben@decadent.org.uk> wrote:
> On Wed, 2016-08-03 at 09:46 -0700, Andy Lutomirski wrote:
> [...]
>> And it gets rid of the IMO extremely nasty temporary key.  I
>> personally think that reproducible builds would add considerable value
>> to many use cases, and we currently can't simultaneously support
>> reproducible builds and Secure Boot without a big mess involving
>> trusted parties, and the whole point of reproducible builds is to
>> avoid needed to trust the packager.
> [...]
>
> You need that trusted party to supply a signature for the kernel, so
> why is it so much worse to have them do that for the modules as well?
>

For Chromium-like setups, I don't think the kernel is signed as such
-- it's verified (by hash?  by loading from trusted storage?) and
executed.

> As you may be aware, I'm dealing with this in Debian by putting
> detached signatures into the source package that builds signed
> binaries.  The two package build processes are each reproducible (aside
> from a recently discovered dependence on whether /bin/sh is bash or
> dash).

That is a nifty solution, although don't you have to put a detached
signature into the source package for every single module?  Limiting
it to just one signature for the kernel seems like it would be a win.

--Andy