[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: secure boot

From: Maxime Devos
Subject: Re: secure boot
Date: Wed, 24 Aug 2022 19:24:56 +0200
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.12.0

On 24-08-2022 05:07, Philip McGrath wrote:
I could imagine a process like this:

  1. Build the binary that needs to be signed.
  2. Outside of the Guix build environment, create a detached signature
     for the binary using your secret key.
  3. Add the detached signature to the Guix store, perhaps with 'local-file'.
  4. Use Guix to attach the signature to the built binary.
  5. Use the signed binary in your operating-system configuration.

To implement this, you could have a look at "dynamic dependencies" in guix/store.scm and guix/graftsscm.

From the with-build-handler docstring:

Build handlers are useful to announce a build plan with 'show-what-to-build' and to implement dry runs (by not invoking CONTINUE) in a way that gracefully deals with \"dynamic dependencies\" such as grafts---derivations that depend
on the build output of a previous derivation."

On grafts: the derivation of the grafted version depend on what the references of the store item used to be, this can only be decided outside the store (kind of similar to this situation).


Attachment: OpenPGP_0x49E3EE22191725EE.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature
Description: OpenPGP digital signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]