© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
0e1f616
(Get the code!)
Thanks Mario, very helpful. I've found something else that worries me:
The Linux Vendor Firmware Service re-packs a cab with a firmware, a detached signature, and some metadata. An example is at [1].
I haven't yet been able to find any chain of trust from a key to the cabfile to download. If the appstream data with firmware update information is published alongside e.g. the distribution's DEP-11 data, then APT will provide this via the /etc/apt/
If the cabfile metadata comes from [2] then I haven't yet found a way to verify this file or its recentness.
The detached signature in the cab file is not sufficient:
- A malicious entity may find a bug in the cab extraction process and exploit the extraction phase, bypassing the signature entirely.
- A malicious entity may manipulate the metadata file at will.
- A malicious entity may copy-and-paste the signature and firmware files from cab to cab.
- A malicious entity could supply an old, known-problematic, but previously valid cab, unchanged.
I'll continue investigating but wanted to share my concerns before starting a long weekend.
Thanks
1: https:/
2: https:/