Linux /boot signing script
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 1.6k
- Forks
- 211
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 6
Description
I think it is about time that we solve the really annoying problem of initrd mismatch after updates.
We can create a linux package called heads-sign that adds an apt hook and prompts to sign your /boot after an update that involved a kernel or initrd. We can add a grub hook as well.
Right now, if I update my computer, forget that I updated it and reboot I won't know if the initrd (or more rarely kernel) was changed by apt or an adversary.
Also given that PureOS is running on top of the Debian Buster repository initrd updates are quite common and this issue is really annoying me.
I tried creating the script once, but I messed it up. Unfortunately I don't think I'm not the most qualified person to create a PR for this.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing how this project handles Linux packages and signing, then investigate the proposed apt hook and grub hook around updates to /boot. Done means a heads-sign package prompts for signing when a kernel or initrd changes, while the required design and implementation details still need maintainer discussion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100