4 ms·
The downloaders will have to be aware of the "no warranty" clause of the license Linux uses, and take responsibility for the software they bring into their envi
by bonzoesc 15y ago
The downloaders will have to be aware of the "no warranty" clause of the license Linux uses, and take responsibility for the software they bring into their environment. The kernel developers provide instructions[1] on how to cryptographically verify the authenticity of a downloaded kernel, including building a PGP "trust path" to their key.
1: http://kernel.org/signature.html http://kernel.org/signature.html
- recoiledsnake 15y agoThe signatures themselves are hosted on kernel.org...
- bonzoesc 15y agoSo? An attacker's not going to have the private key they were created with, and probably won't have a private key that you have an existing trust relationship to.