Re: [Devil-linux-develop] remote update

[Heiko Z. <he...@zu...>]

Bruce Smith wrote:

>>I need to implement the option of remotely updating DL when it's on a 
>>USB stick or something.
>>
>>So far I couldn't really decide how I want to do this, so it's reliable 
>>and most of all secure.
>>
>>The update must be signed (pgp) and performed from within initrd, that's 
>>the easy part.
>>
>>My original idea was to add the iso image as boot.cd.new to the root of 
>>the media and then just check for it's existence, verify it, rename it 
>>to bootcd.iso and continue.
> 
> So, the USB stick has to be large enough to hold TWO copies of the ISO?

Yes correct.

>>The major problem is that it's easy to temper with the verification of 
>>the signature, by replacing the initrd on the memory stick.
> 
> 
> You could put the sig on a secure location on the internet instead of on
> the media.  But then initrd would need the network up.  :-(

That's then still the same problem, since initrd would need to verify 
itself,  which doesn't make much sense.

Heiko