Re: [BUG] buildman does not check signature of toolchain

2021-10-31 Thread Simon Glass
Hi Heinrich, On Wed, 27 Oct 2021 at 08:23, Heinrich Schuchardt wrote: > > On 10/27/21 16:05, Simon Glass wrote: > > Hi Heinrich, > > > > On Tue, 26 Oct 2021 at 13:43, Heinrich Schuchardt > > wrote: > >> > >> Downloading binaries and executing without checking the authenticity is > >> at least

Re: [BUG] buildman does not check signature of toolchain

2021-10-27 Thread Heinrich Schuchardt
On 10/27/21 16:05, Simon Glass wrote: Hi Heinrich, On Tue, 26 Oct 2021 at 13:43, Heinrich Schuchardt wrote: Downloading binaries and executing without checking the authenticity is at least unwise. When binman downloads GCC it should also download and verify the GPG signatures. Additionally