On Fri, Jul 23, 2021 at 08:09:07PM +0300, Andrei POPESCU wrote: [...] > > They're not even free > > to rebuild the firmware and verify that it matches the official binary. > > All they can do is look at the code and hope that the binary blob actually > > matches it. > > Unless I'm missing something (which is very much possible, I'm way out > of my depth here) rebuilding to verify it matches the official binary > should still be possible. > > Care to elaborate on why you think this would be a problem? You would have to have access at the vendor's build tools (compiler, linker) and at the "build scripts", at least at enough of them to be able to reproduce compile options, etc. Depending on the "signature infrastructure" there might be other "nice" challenges. All in all, the vendor would have to be very cooperative. Cheers - t
Attachment:
signature.asc
Description: Digital signature