On Tue, 2018-05-15 at 08:32 -0400, Josh Boyer wrote:

One aspect that was always a concern to some is whether the firmware files
were modified directly to have the signature attached to them.  That may
run afoul of the "no modification" license that most blobs are shipped
under.  Does IMA have the signatures for the files stored in xattrs or in
some other detached manner?

They're stored as xattrs.  RPM has support for including file
signatures in the RPM header.

Mimi