diff options
| author | Daniel Micay <danielmicay@gmail.com> | 2020-03-14 23:37:48 -0400 |
|---|---|---|
| committer | Daniel Micay <danielmicay@gmail.com> | 2020-03-14 23:37:48 -0400 |
| commit | 56582135f13fd26394d390d0ffe1385d1915080d (patch) | |
| tree | 3e82669cd610e64c926f96e61e5d132f6a4e23bc /static/build.html | |
| parent | 84bc8705b469b95983d8b1adbb19cb9bacf620df (diff) | |
OS signing key encryption is properly supported
Diffstat (limited to 'static/build.html')
| -rw-r--r-- | static/build.html | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/static/build.html b/static/build.html index 0fe4ceb9..c54d2aa0 100644 --- a/static/build.html +++ b/static/build.html @@ -425,9 +425,9 @@ mv vendor/android-prepare-vendor/DEVICE/BUILD_ID/vendor/google_devices/* vendor/ factory reset. Note that the keys are used for a lot more than simply verifying updates and verified boot.</p> - <p>The keys should not be given passwords due to limitations in the upstream scripts. - If you want to secure them at rest, you should take a different approach where they - can still be available to the signing scripts as a directory of unencrypted keys.</p> + <p>You should set a passphrase for the signing keys to protect them at rest. The + GrapheneOS release signing script expects the same passphrase to be used for each of + the keys.</p> <p>The sample certificate subject should be replaced with your own information.</p> |