I had no idea this issue had been identified. While I find this tool very useful, the project is seeming rather questionable to me now.

  • nialv7@lemmy.world
    16·
    10 days ago

    While this is true, it only requires the shim and grub to be copied for another distro.

    From other comments there are a lot more blobs than just these two.

        • davad@lemmy.world
          1·
          5 hours ago

          I think they did say that in the older thread. But for proper security, you shouldn’t have to trust them. You should have build tools that will re-fetch everything to create an identical build. That gives a clear chain of custody, which proves that morning has been tampered with.