4 ms·
You can sign updates with an offline key (ideally like a hardware key), this is what APT based repositories do/allow
by dinosaurdynasty 2y ago
You can sign updates with an offline key (ideally like a hardware key), this is what APT based repositories do/allow
- hypeatei 2y agoSure, but how do you deal with expiration or revocation of that key? If someone is using an old version which doesn't know about the new key then you're back at square one right?
- freedomben 2y agoLinux package managers like apt and dnf deal with this as well. When a key is getting old, you generate a new key with an updated expiration and push it out using the old key to verify it. If the old key expires before a new key is delivered, then you have a problem. This has happened to me a few times and it is a pain in the butt. You basically have to disable key checking in order to receive the new key, which breaks the security.
- Sleaker 2y agoI would say it doesn't break it, it means you must manually inspect it to verify it Is indeed a key being published from the source you expect. But that's kind of the point right? If automated checks don't work, then you have to rely on the user doing a manual inspection.
- ramchip 2y agoA good solution to this is to have multiple roles and use threshold signatures: https://theupdateframework.io/ https://theupdateframework.io/