{"action":"opened","issue":{"url":"https://api.github.com/repos/mcgrof/crda/issues/3","labels_url":"https://api.github.com/repos/mcgrof/crda/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/mcgrof/crda/issues/3/comments","events_url":"https://api.github.com/repos/mcgrof/crda/issues/3/events","html_url":"https://github.com/mcgrof/crda/issues/3","id":63039751,"number":3,"title":"Signature of DB always valid if you build without OpenSSL and gcrypt","user":{"login":"ericschultz","id":94169,"avatar_url":"https://avatars.githubusercontent.com/u/94169?v=3","gravatar_id":"","url":"https://api.github.com/users/ericschultz","html_url":"https://github.com/ericschultz","followers_url":"https://api.github.com/users/ericschultz/followers","following_url":"https://api.github.com/users/ericschultz/following{/other_user}","gists_url":"https://api.github.com/users/ericschultz/gists{/gist_id}","starred_url":"https://api.github.com/users/ericschultz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericschultz/subscriptions","organizations_url":"https://api.github.com/users/ericschultz/orgs","repos_url":"https://api.github.com/users/ericschultz/repos","events_url":"https://api.github.com/users/ericschultz/events{/privacy}","received_events_url":"https://api.github.com/users/ericschultz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-19T17:07:19Z","updated_at":"2015-03-19T17:07:19Z","closed_at":null,"body":"This may not be an actual issue but I wanted to bring it up. In the event someone builds without OpenSSL and gcrypt, reglib_verify_db_signature always returns 1 (available at https://github.com/mcgrof/crda/blob/master/reglib.c#L203). In the event of DB corruption, regulatory rules could be totally invalid but the CRDA wouldn't know and would return them to the kernel anyway. I'm not sure if this is a big issue since, if you're building a new version of CRDA, you probably comfortable taking your regulatory risks into your own hands. That said, it still strikes me as potentially dangerous for users to be able to unknowingly break regulatory requirements.\r\n\r\nI don't know if this is feasible, or even necessary, but perhap, the regdb could have a super basic unsigned hash as a protective measure in the event of someone rebuilding CRDA without gcrypt and OpenSSL and database corruption."}}