mirror of
https://github.com/genodelabs/genode.git
synced 2025-05-09 03:52:56 +00:00
f8fd202a1c
This patch equips the depot_download subsystem with the option to explicitly skip the signature verification for downloads by specifying the attribute 'verify="no"' for an <installation> item. This is useful in scenarios where the lack of integrity of downloaded content does not pose a risk, e.g., for untrusted applications that are rigidly sandboxed, or during development. Note that this option does not entirely discarge the signature checking. Whenever an download has dependencies that are verifyable - for which the public key exists in the depot - the dependencies are still verified. This allows untrusted content to depend of verifyable content while protecting the integrity the verifyable content. Issue #4804
This directory is a source-code repository containing Genode-specific services and applications. In contrast to the components hosted in the 'os' repository, programs contained in 'gems' are able to leverage the functionalities provided by higher-level repositories such as 'libports'. To use the 'gems' repository, make sure to also add those repositories to your build configuraion.