Re: [Devil-linux-develop] remote update

[Bruce S. <bw...@ar...>]

> I need to implement the option of remotely updating DL when it's on a 
> USB stick or something.
> 
> So far I couldn't really decide how I want to do this, so it's reliable 
> and most of all secure.
> 
> The update must be signed (pgp) and performed from within initrd, that's 
> the easy part.
> 
> My original idea was to add the iso image as boot.cd.new to the root of 
> the media and then just check for it's existence, verify it, rename it 
> to bootcd.iso and continue.

So, the USB stick has to be large enough to hold TWO copies of the ISO?

> The major problem is that it's easy to temper with the verification of 
> the signature, by replacing the initrd on the memory stick.

You could put the sig on a secure location on the internet instead of on
the media.  But then initrd would need the network up.  :-(

 - BS