61 lines
2.2 KiB
Diff
61 lines
2.2 KiB
Diff
From 71133b4337411ddd550d5e5ef68a12c510740b2c Mon Sep 17 00:00:00 2001
|
|
From: Dorian Stoll <dorian.stoll@tmsp.io>
|
|
Date: Sat, 22 Jul 2023 10:45:33 +0200
|
|
Subject: [PATCH] Use a custom key and certificate for Secure Boot signing
|
|
|
|
Signed-off-by: Dorian Stoll <dorian.stoll@tmsp.io>
|
|
---
|
|
redhat/kernel.spec.template | 15 +++++++++------
|
|
1 file changed, 9 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
|
|
index 28df94e561d4..fd44abc4118a 100644
|
|
--- a/redhat/kernel.spec.template
|
|
+++ b/redhat/kernel.spec.template
|
|
@@ -805,6 +805,7 @@ BuildRequires: system-sb-certs
|
|
%ifarch x86_64 aarch64
|
|
BuildRequires: nss-tools
|
|
BuildRequires: pesign >= 0.10-4
|
|
+BuildRequires: sbsigntools
|
|
%endif
|
|
%endif
|
|
%endif
|
|
@@ -864,6 +865,13 @@ Source1: Makefile.rhelver
|
|
%define signing_key_filename kernel-signing-s390.cer
|
|
%endif
|
|
|
|
+%ifarch x86_64 aarch64
|
|
+
|
|
+Source7001: MOK.key
|
|
+Source7002: MOK.crt
|
|
+
|
|
+%endif
|
|
+
|
|
%if %{?released_kernel}
|
|
|
|
Source10: redhatsecurebootca5.cer
|
|
@@ -2096,9 +2104,7 @@ BuildKernel() {
|
|
SignImage=$KernelImage
|
|
|
|
%ifarch x86_64 aarch64
|
|
- %pesign -s -i $SignImage -o vmlinuz.tmp -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0}
|
|
- %pesign -s -i vmlinuz.tmp -o vmlinuz.signed -a %{secureboot_ca_1} -c %{secureboot_key_1} -n %{pesign_name_1}
|
|
- rm vmlinuz.tmp
|
|
+ sbsign --key %{SOURCE7001} --cert %{SOURCE7002} --output vmlinuz.signed $SignImage
|
|
%endif
|
|
%ifarch s390x ppc64le
|
|
if [ -x /usr/bin/rpm-sign ]; then
|
|
@@ -2650,9 +2656,6 @@ BuildKernel() {
|
|
# Red Hat UEFI Secure Boot CA cert, which can be used to authenticate the kernel
|
|
mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer
|
|
%ifarch x86_64 aarch64
|
|
- install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20200609.cer
|
|
- install -m 0644 %{secureboot_ca_1} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20140212.cer
|
|
- ln -s kernel-signing-ca-20200609.cer $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
|
|
%else
|
|
install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
|
|
%endif
|
|
--
|
|
2.41.0
|
|
|