浏览代码

Merge pull request #1938 from hashworks/archlinux/AddLSignKeyNote

Arch Linux: Add note on lsign-key
Tianon Gravi 4 年之前
父节点
当前提交
4ba2d740f4
共有 1 个文件被更改,包括 2 次插入0 次删除
  1. 2 0
      archlinux/content.md

+ 2 - 0
archlinux/content.md

@@ -21,6 +21,8 @@ This image is intended to serve the following goals:
 -	`pacman` needs to work out of the box
 -	`pacman` needs to work out of the box
 -	All installed packages have to be kept unmodified
 -	All installed packages have to be kept unmodified
 
 
+> ⚠️⚠️⚠️ NOTE: For Security Reasons, these images strip the pacman lsign key. This is because the same key would be spread to all containers of the same image, allowing for malicious actors to inject packages (via, for example, a man-in-the-middle). In order to create an lsign-key run `pacman-key --init` on the first execution, but be careful to not redistribute that key. ⚠️⚠️⚠️
+
 ## Availability
 ## Availability
 
 
 Root filesystem tarballs are [provided by our GitLab](https://gitlab.archlinux.org/archlinux/archlinux-docker/-/releases) for at least two months.
 Root filesystem tarballs are [provided by our GitLab](https://gitlab.archlinux.org/archlinux/archlinux-docker/-/releases) for at least two months.