On Thu, Oct 14, 2021 at 6:47 PM Ard Biesheuvel <ardb@xxxxxxxxxx> wrote: > > On Wed, 13 Oct 2021 at 22:07, Matthew Wilcox (Oracle) > <willy@xxxxxxxxxxxxx> wrote: > > > > If the config file specifies a signing key, use it to sign > > the kernel so that machines with SecureBoot enabled can boot. > > See https://wiki.debian.org/SecureBoot > > > > Signed-off-by: Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx> > > For the change itself > > Acked-by: Ard Biesheuvel <ardb@xxxxxxxxxx> > > although I'd suggest to fix the subject not to refer to Machine Owner > Keys, as I don't see anything shim related here (i.e., if you sign > using a key that is listed in db, it should also work) > > > > --- > > scripts/package/builddeb | 10 +++++++++- > > 1 file changed, 9 insertions(+), 1 deletion(-) > > > > diff --git a/scripts/package/builddeb b/scripts/package/builddeb > > index 91a502bb97e8..4fa6ff2b5cac 100755 > > --- a/scripts/package/builddeb > > +++ b/scripts/package/builddeb > > @@ -147,7 +147,15 @@ else > > cp System.map "$tmpdir/boot/System.map-$version" > > cp $KCONFIG_CONFIG "$tmpdir/boot/config-$version" > > fi > > -cp "$($MAKE -s -f $srctree/Makefile image_name)" "$tmpdir/$installed_image_path" > > + > > +vmlinux=$($MAKE -s -f $srctree/Makefile image_name) > > +if is_enabled CONFIG_MODULE_SIG; then > > + cert=$srctree/$(grep ^CONFIG_MODULE_SIG_KEY= include/config/auto.conf | cut -d\" -f2) > > + key=${cert%pem}priv > > + sbsign --key $key --cert $cert "$vmlinux" --output "$tmpdir/$installed_image_path" > > +else > > + cp "$vmlinux" "$tmpdir/$installed_image_path" > > +fi > > > > if is_enabled CONFIG_OF_EARLY_FLATTREE; then > > # Only some architectures with OF support have this target > > -- > > 2.32.0 > > How to compile this patch? "make bindeb-pkg" fails with Can't load key from file './certs/signing_key.priv' Also, sbsign emits "Invalid DOS header magic" error if CONFIG_EFI_STUB is not set. The CONFIG name might depend on arch. CONFIG_EFI for ARCH=arm64, but CONFIG_EFI_STUB for ARCH=x86. If you require sbsign, you need to update Build-Depends ? My build log: masahiro@grover:~/workspace/linux-kbuild$ make bindeb-pkg -j8 sh ./scripts/package/mkdebian dpkg-buildpackage -r"fakeroot -u" -a$(cat debian/arch) -b -nc -uc dpkg-buildpackage: info: source package linux-upstream dpkg-buildpackage: info: source version 5.15.0-rc2+-1 dpkg-buildpackage: info: source distribution hirsute dpkg-buildpackage: info: source changed by masahiro <masahiro@grover> dpkg-buildpackage: info: host architecture amd64 dpkg-source --before-build . debian/rules binary make KERNELRELEASE=5.15.0-rc2+ ARCH=x86 KBUILD_BUILD_VERSION=1 -f ./Makefile DESCEND objtool CALL scripts/atomic/check-atomics.sh CALL scripts/checksyscalls.sh CHK include/generated/compile.h Kernel: arch/x86/boot/bzImage is ready (#1) make KERNELRELEASE=5.15.0-rc2+ ARCH=x86 KBUILD_BUILD_VERSION=1 -f ./Makefile intdeb-pkg sh ./scripts/package/builddeb Can't load key from file './certs/signing_key.priv' 139999825022720:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:69:fopen('./certs/signing_key.priv','r') 139999825022720:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:76: make[4]: *** [scripts/Makefile.package:87: intdeb-pkg] Error 1 make[3]: *** [Makefile:1539: intdeb-pkg] Error 2 make[2]: *** [debian/rules:13: binary-arch] Error 2 dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2 make[1]: *** [scripts/Makefile.package:83: bindeb-pkg] Error 2 make: *** [Makefile:1539: bindeb-pkg] Error 2 CC'ed Ben in case he has more comments. -- Best Regards Masahiro Yamada
