search

ceph / merfi

Finds and signs files with different signing tools (gpg, rpm-sign)
MIT License
3 stars 3 forks source link

RFE: sign ISO contents #4

Closed ktdreyer closed 9 years ago

ktdreyer commented 9 years ago

merfi should be able to do the following:

  1. Point at an ISO on the command line
  2. Unpack the ISO's contents
  3. Search the ISO's contents for apt repositories
  4. For each apt repository, sign the Release file metadata
  5. For each apt repository, write a "release.asc" file into the root of the repo. This release.asc file should contain the public key that was used to sign the repo.
  6. Re-generate the ISO with these modifications.

(Additionally, it would be good if merfi could sha256sum the resulting ISO, and then GPG-inline-sign the resulting ".SHA256SUM" file... but that could be a separate RFE.)

FYI on Ubuntu I've used p7zip to extract the contents of ISOs without needing root access. A fallback option would be to use "sudo mount".

ktdreyer commented 9 years ago

Fixed in https://github.com/alfredodeza/merfi/pull/10