Skip to content

Verify raspberry pi blob script download

Sunil Mohan Adapa requested to merge bashrc:bashrc/verify-blobs into master

Created by: bashrc

This verifies the rpi-update script which gets downloaded in order to shut down one possible avenue for nefariousness when creating an image which potentially might be widely used. Possibly there may be other bad stuff within the rpi-update script itself, and it may be possible to request a specific firmware version which could then also be checked.

Aside from the general badness of proprietary blobs my intuition is that if any adversary is going to try to engage in "equipment interference" then the manner in which the blob (or other firmware) is obtained is a likely route, since this would then scale to however many copies of the resulting image are subsequently made.

Merge request reports

Loading