[PATCH 1/3] [V5] Add support for GPG signature enforcement on booted

[Samuel Mendoza-Jonas]

On Tue, 2016-08-23 at 17:00 -0500, Timothy Pearson wrote:
> On 08/19/2016 03:38 PM, Timothy Pearson wrote:
> > 
> > On 08/18/2016 08:32 PM, Samuel Mendoza-Jonas wrote:
> > > 
> > > Sure, it makes sense to err on the side of caution here. The other case
> > > where you check for the string "ENCRYPTED" would be a case for strncmp
> > > thought I imagine, since the length of the string is static.
> > 
> > It's possible, though in general I'd prefer the parsing to remain
> > consistent from line to line.
> > 
> > If this is the only nit to be picked can this series be merged? :-)
> > 
> > Thanks!
> > 
> 
> I just wanted to follow up on this patch series.
> 
> Thanks!

Hi! Excuse me not following up, got caught up putting out some other
fires :)

I'm pretty happy to merge this I think. I've tested with buildroot with
only a moderate amount of hair-pulling, and everything acts as expected.
One, maybe two nitpicks, but I can handle those myself when I merge,
being:
- I'll change --with-signed-boot to default=no
- I might add a comment to a file or commit message to stress that it's
probably best to hold off using the word 'secure' too much unless this
is used in conjunction with a proper trusted-boot implementation so that
you can trust the integrity of the initramfs. If you like I can send
that to you to bikeshed as well :)

Cheers,
Sam