Re: [OpenWrt-Devel] RFC: check signatures of sysupgrades via ucert

2019-04-26 Thread Petr Štetiar
Daniel Golle [2019-04-24 00:33:53]: Hi, > I don't think using UCI for this makes sense, it makes sense to me, as it allows easier opt-in via custom uci-defaults script for downstream projects during the transition period. > because people also use sysupgrade in failsafe mode and then may not

Re: [OpenWrt-Devel] RFC: check signatures of sysupgrades via ucert

2019-04-23 Thread Daniel Golle
Hi Paul, On Wed, Apr 24, 2019 at 12:02:49AM +0200, Paul Spooren wrote: > Hi all, > > to improve security of the router sysupgrade process, it's sane to check > firmware images for signatures of trusted parties. While this should > always be optional (aka no vendor locking), it helps *basic*

[OpenWrt-Devel] RFC: check signatures of sysupgrades via ucert

2019-04-23 Thread Paul Spooren
Hi all, to improve security of the router sysupgrade process, it's sane to check firmware images for signatures of trusted parties. While this should always be optional (aka no vendor locking), it helps *basic* users to easily verify that they are installing the image they intended. It is