[meta-issue] Push OEMs to maintain+ detach sign their ISOs and inlude their distro public key in tree

linuxboot / heads

A minimal Linux that runs as a coreboot or LinuxBoot ROM payload to provide a secure, flexible boot environment for laptops, workstations and servers.

https://osresearch.net/

GNU General Public License v2.0

1.4k stars 180 forks source link

[meta-issue] Push OEMs to maintain+ detach sign their ISOs and inlude their distro public key in tree #1637

Open tlaurion opened 3 months ago

tlaurion commented 3 months ago

[ ] https://github.com/Nitrokey/qubes-oem/issues/20
[ ] https://github.com/Nitrokey/ubuntu-oem/issues/11
[ ] @JonathonHall-Purism pureos key in tree but no detached signatures
[ ] others?

tlaurion commented 3 months ago

Also think of a mechanism to check public keys against their expiration date, warning of expiration proactively in CI. Tails is becoming an issue as per last pr #1631

Track https://github.com/ben-grande/qusal/issues/46 since I have no clue how to efficiently do that