This commit is contained in:
Justin Kromlinger 2023-11-18 17:24:36 +01:00
parent aaffed1742
commit a162c7ebbe
No known key found for this signature in database
GPG Key ID: 69EF6D9E49A64EB8

View File

@ -42,7 +42,7 @@ $ cosign verify ghcr.io/archlinux/archlinux:latest --certificate-identity-regexp
⚠️⚠️⚠️ NOTE: For Security Reasons, these images strip the pacman lsign key.
This is because the same key would be spread to all containers of the same
image, allowing for malicious actors to inject packages (via, for example,
a man-in-the-middle). In order to create an lsign-key run `pacman-key
a man-in-the-middle). In order to create a lsign-key run `pacman-key
--init` on the first execution, but be careful to not redistribute that
key.⚠️⚠️⚠️
>>>