On Fri, Dec 17, 2021 at 7:04 AM Matthew Wilcox <willy@xxxxxxxxxxxxx> wrote: > > On Thu, Nov 04, 2021 at 06:28:40PM +0900, Masahiro Yamada wrote: > > On Thu, Oct 14, 2021 at 6:47 PM Ard Biesheuvel <ardb@xxxxxxxxxx> wrote: > > > > > > On Wed, 13 Oct 2021 at 22:07, Matthew Wilcox (Oracle) > > > <willy@xxxxxxxxxxxxx> wrote: > > > > > > > > If the config file specifies a signing key, use it to sign > > > > the kernel so that machines with SecureBoot enabled can boot. > > > > See https://wiki.debian.org/SecureBoot > > > > > > > > Signed-off-by: Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx> > > > > > > For the change itself > > > > > > Acked-by: Ard Biesheuvel <ardb@xxxxxxxxxx> > > > > > > although I'd suggest to fix the subject not to refer to Machine Owner > > > Keys, as I don't see anything shim related here (i.e., if you sign > > > using a key that is listed in db, it should also work) > > > > > > > > > > --- > > > > scripts/package/builddeb | 10 +++++++++- > > > > 1 file changed, 9 insertions(+), 1 deletion(-) > > > > > > > > diff --git a/scripts/package/builddeb b/scripts/package/builddeb > > > > index 91a502bb97e8..4fa6ff2b5cac 100755 > > > > --- a/scripts/package/builddeb > > > > +++ b/scripts/package/builddeb > > > > @@ -147,7 +147,15 @@ else > > > > cp System.map "$tmpdir/boot/System.map-$version" > > > > cp $KCONFIG_CONFIG "$tmpdir/boot/config-$version" > > > > fi > > > > -cp "$($MAKE -s -f $srctree/Makefile image_name)" "$tmpdir/$installed_image_path" > > > > + > > > > +vmlinux=$($MAKE -s -f $srctree/Makefile image_name) > > > > +if is_enabled CONFIG_MODULE_SIG; then > > > > + cert=$srctree/$(grep ^CONFIG_MODULE_SIG_KEY= include/config/auto.conf | cut -d\" -f2) > > > > + key=${cert%pem}priv > > > > + sbsign --key $key --cert $cert "$vmlinux" --output "$tmpdir/$installed_image_path" > > > > +else > > > > + cp "$vmlinux" "$tmpdir/$installed_image_path" > > > > +fi > > > > > > > > if is_enabled CONFIG_OF_EARLY_FLATTREE; then > > > > # Only some architectures with OF support have this target > > > > -- > > > > 2.32.0 > > > > > > > > How to compile this patch? > > > > "make bindeb-pkg" fails with > > Can't load key from file './certs/signing_key.priv' > > I'm sorry; I missed this email. > > I don't know why you're seeing this error, exactly. I'm just trying to > automate the step here: [1] Apply your patch [2] Enable CONFIG_MODULE_SIG [3] make bindeb-pkg That's all. > https://wiki.debian.org/SecureBoot#Using_your_key_to_sign_your_kernel > > Have you followed the other steps on that page; ie do you have: > signing_key.priv, signing_key.der and signing_key.pem files? certs/signing_key.pem is automatically generated by Kbuild. There is no such file as signing_key.priv You can see the content of certs/signing_key.pem This file contains both certificate and private key. > > > > > Also, sbsign emits "Invalid DOS header magic" error > > if CONFIG_EFI_STUB is not set. > > > > The CONFIG name might depend on arch. > > CONFIG_EFI for ARCH=arm64, but CONFIG_EFI_STUB for ARCH=x86. > > > > > > If you require sbsign, you need to update Build-Depends ? > > It looks like we should add a few extra checks before running sbsign ... > > > sh ./scripts/package/builddeb > > Can't load key from file './certs/signing_key.priv' > > 139999825022720:error:02001002:system library:fopen:No such file or > > directory:../crypto/bio/bss_file.c:69:fopen('./certs/signing_key.priv','r') > > 139999825022720:error:2006D080:BIO routines:BIO_new_file:no such > > file:../crypto/bio/bss_file.c:76: > > make[4]: *** [scripts/Makefile.package:87: intdeb-pkg] Error 1 > > make[3]: *** [Makefile:1539: intdeb-pkg] Error 2 > > make[2]: *** [debian/rules:13: binary-arch] Error 2 > > dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2 > > make[1]: *** [scripts/Makefile.package:83: bindeb-pkg] Error 2 > > make: *** [Makefile:1539: bindeb-pkg] Error 2 > > -- Best Regards Masahiro Yamada
