[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: secure boot
From: |
Maxime Devos |
Subject: |
Re: secure boot |
Date: |
Wed, 24 Aug 2022 19:24:56 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.12.0 |
On 24-08-2022 05:07, Philip McGrath wrote:
I could imagine a process like this:
1. Build the binary that needs to be signed.
2. Outside of the Guix build environment, create a detached signature
for the binary using your secret key.
3. Add the detached signature to the Guix store, perhaps with 'local-file'.
4. Use Guix to attach the signature to the built binary.
5. Use the signed binary in your operating-system configuration.
To implement this, you could have a look at "dynamic dependencies" in
guix/store.scm and guix/graftsscm.
From the with-build-handler docstring:
Build handlers are useful to announce a build plan with
'show-what-to-build'
and to implement dry runs (by not invoking CONTINUE) in a way that
gracefully
deals with \"dynamic dependencies\" such as grafts---derivations that
depend
on the build output of a previous derivation."
On grafts: the derivation of the grafted version depend on what the
references of the store item used to be, this can only be decided
outside the store (kind of similar to this situation).
Greeetings,
Maxime
OpenPGP_0x49E3EE22191725EE.asc
Description: OpenPGP public key
OpenPGP_signature
Description: OpenPGP digital signature