linux-kernel - Re: Building signed debs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFSh4UwkXyTnECgJBQA4uBqD0QOFiUBvj=aOy7qzXZqAZKYkcQ@mail.gmail.com>
Date:   Mon, 11 Dec 2023 10:19:06 +0000
From:   Tom Cook <tom.k.cook@...il.com>
To:     Masahiro Yamada <masahiroy@...nel.org>
Cc:     linux-modules <linux-modules@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: Building signed debs

On Sat, Dec 9, 2023 at 6:18 PM Masahiro Yamada <masahiroy@...nel.org> wrote:
> On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <tom.k.cook@...il.com> wrote:
> >
> > I'm trying to build a signed .deb kernel package of
> > https://github.com/torvalds/linux/tree/v6.6.  I've copied
> > certs/default_x509.genkey to certs/x509.genkey.  The .config is the
> > one from Ubuntu 23.10's default kernel with all new options accepted
> > at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
> > CONFIG_SYSTEM_REVOCATION_KEYS="".
> >
> > This builds the kernel and modules, signs the modules, compresses the
> > modules and then attempts to sign the modules again.  That fails,
> > because the .ko module files are now .ko.zst files and the file it's
> > trying to sign isn't there.  Full failure is pasted below.
>
>
>
> Modules are signed before the compression.

Reading back through my earlier email, I wasn't clear that when I said "This
builds the kernel..." I meant "`make deb-pkg` builds the kernel".  I'm not
doing anything outlandish here, I think, just expecting the build system to
work.

Regards,
Tom