{"push_id":1174998400,"size":1,"distinct_size":1,"ref":"refs/heads/sigverify","head":"9b8b950d8cf7847bd78c8aa62bcb1df0d69399c5","before":"fd79539d6674dfeabbc99dfc0de2a0831a4206b1","commits":[{"sha":"9b8b950d8cf7847bd78c8aa62bcb1df0d69399c5","author":{"name":"Tim Pepper","email":"9ca68eda3abf78fbf634adcaaa20e3fe0416096a@linux.intel.com"},"message":"Implement signature verification\n\nThis patch adds functionality for the swupd client to do signature\nverification on the MoM, which ensures a root of trust for the rest\nof the update by guaranteeing the authenticity of the MoM and content\nit includes.\n\nAs we focus now on just verifying the signed MoM, a number of functions now\nbecome static to src/signature.c.\n\nBy default MoM signature verification is disabled.  Configure\n--enable-signature-verification to enable it.  When enabled the default\ncert for verification is /usr/share/clear/update-ca/ClearLinuxRoot.pem, as\nspecified by concatenation of SWUPDCERT onto UPDATE_CA_CERTS_PATH.  The\nSWUPDCERT can be overridden via configure --with-swupdcert=some.pem.\n\nWhen signature verification is enabled, and the MoM's signature does _NOT_\nverify, currently only a warning is presented but the swupd operation\ncontinues.  In the future signature verification will become mandatory.\nWe first need to sort out a few details with mixer to insure the right\nthing happens there.\n\nSigned-off-by: Tim Pepper <timothy.c.pepper@linux.intel.com>\nSigned-off-by: Tudor Marcu <tudor.marcu@intel.com>","distinct":true,"url":"https://api.github.com/repos/tpepper/swupd-client/commits/9b8b950d8cf7847bd78c8aa62bcb1df0d69399c5"}]}
{"actor":{"display_login":"tpepper"}}