4 ms·

How does the binary signing work? I’m not looking to hack anything, but it sounds cool to have signed binaries only on linux!!

• _djo_ 1y ago
  Varies from manufacturer to manufacturer. This is Ingenico's approach, for instance: https://ingenico.com/en/products-services/services/security-solutions/e-sign https://ingenico.com/en/products-services/services/security-...
• shakna 1y ago
  Whilst I'm sure they use something else, Linux does have an experimental extension, "Integrity Measurement Architecture" extension that allows you to sign and verify RSA keys against every binary.
  • zoobab 1y ago
    ah good to know, I wanted that feature back in 2018 :-)
• lelanthran 1y ago
  Varies from vendor to vendor; signed-binaries-only is part of the certification process but the exact mechanism itself is not (or maybe that has changed, not sure). The way it worked in 2003 (when I first wrote EMV applications) was, when we have a binary that we are ready to deploy, we ship that binary to the manufacturer (Schlumbeger(sp?), at that time), if it passes cert-testing, they sign it and ship it back and that's what we would program the terminals with. The way it works now is pretty much the same - we build an APK bundle, send it to the manufacturer (Verifone, Pax, etc) and after signing they make it available on their appstore which their terminal can access.