A review of the kernel's release-signing practices

At the behest of the Linux Foundation, a security-oriented review of thekernel project's release-signing and key-management practices was done; thereport from this work has now been published.

This reviewresulted in seven recommendations that can help improve the robustness ofthe security and use of the signing keys for the LinuxKernel. Additionally, Trail of Bits suggested that more comprehensive andup to date documentation on the current procedures and policies are neededto help organizations around the world to best understand the currentstratagem.

See thefull report for the details.