Re: Proposal: Remove MD5 / SHA1 support from veriexec

On Tue, Aug 22, 2017 at 12:12:19AM +0100, Sevan Janiyan wrote:
> Hello,
> As a two part process, I propose we remove the ability to generate
> signatures using SHA1/MD5 with veriexecgen as a part of NetBSD 8.
> Then in HEAD for NetBSD 9, we remove support for these hashes from the
> remaining components & kernel configuration files.

Removing support to generate these hash types in veriexecgen sounds fine.

Isn't that enough?

If I want to test boot a new kernel on an old installation, I should
not be forced to regen all hashes (but maybe I misunderstood how it works).


Martin