diff --git a/README.md b/README.md index 03e9180..65f51fe 100644 --- a/README.md +++ b/README.md @@ -42,7 +42,7 @@ $ cosign verify ghcr.io/archlinux/archlinux:latest --certificate-identity-regexp ⚠️⚠️⚠️ NOTE: For Security Reasons, these images strip the pacman lsign key. This is because the same key would be spread to all containers of the same image, allowing for malicious actors to inject packages (via, for example, - a man-in-the-middle). In order to create an lsign-key run `pacman-key + a man-in-the-middle). In order to create a lsign-key run `pacman-key --init` on the first execution, but be careful to not redistribute that key.⚠️⚠️⚠️ >>>