From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from SA9PR02CU001.outbound.protection.outlook.com (mail-southcentralusazolkn19013047.outbound.protection.outlook.com [52.103.14.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 11F523EBF07; Sun, 1 Feb 2026 19:30:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.103.14.47 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769974232; cv=fail; b=b/FEW6XcHWXu7lVXcnS2/6ycbSfAgfDoeyXb5sZIye6WmhJvXxtkFs4LYMqZm73zPiJTXgy4k/EJBpS0w/cumaOFzLheYvy2Pq0sDU3Mi0HzVG725aS1HuCMwMvNNqS6Y6Nr1RThtLCG8KidNnBXMc7PRvdd9xwcaIJvoxgIHXY= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769974232; c=relaxed/simple; bh=2humED5yPiZAXq9DPOb4K6rSbXSEHyrK8LiLZOi4fvg=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:MIME-Version; b=pdmlZ+k1n/EpZWxVvS/O3IL5GLmuolpUr+Q9Bn0lacs6ZCtRDw0FmBWhYU44V7taStE8lhZ/Kt+ywkJ4zexck/abtxUm8I3i4YICcuABhBy8Im6YSZtUYkxWhAKjrALWAZL+2Cc2XScqaUnG54u6veXx/izgWkd8TQ5J29vu1Kw= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=outlook.com; spf=pass smtp.mailfrom=outlook.com; dkim=pass (2048-bit key) header.d=outlook.com header.i=@outlook.com header.b=sU3T1FzH; arc=fail smtp.client-ip=52.103.14.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=outlook.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=outlook.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=outlook.com header.i=@outlook.com header.b="sU3T1FzH" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FLFSQLQU4exATq2VbUW5N7mRG2zr2wZ4VP4li7bpq/4nyUFbbRq1+/RISxVcoZjTY2kRij4EOSFxjqILTRGOABDmYH1AAHoB16Up2TOXiMBhFA2tr8Tde6EBh3+r5M/pdZMoff2Qb5BJEH9KvQlB8/hY+5rhajBDSuHYTF8gHSnpzG0a2ftShq+y/EhD1PSQEoty6eoA0FwjNuo1bH10VNEvAW0WFBsD4wGjy30/07ssj7mYeEV5eU5nKwhiSKRwhxpLGb5r5ioIMhdoebplH4CDqzmJjzlooldN8iu1pFx4+FwzR0XDRAndkqqSZtF4g08FSqBmZViD3g57zJGRcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=F86LlFOS8CWChlGLXSohM3AdNG/FO/hsR22WuPM/HTw=; b=WpGpChvHaHdlJzSZOLNePFAHsbpdM/pOPTge6fudBzvWw/f5HSr617C5hj4z5LQgiRHMCJxm7wfhjOeQN+aIm6XAr9YIuJThk6A4mQGGvRYWsLD7+DVQ6u2Oz+pXfATvSBvLaZv5PqXgNk2IG+PJAqgtdLwFqspOHJXN8Q4Bsb51Qa+CuI0tZwnjlOVOZp4f827usG393/vVliNh2ig/KP7IELnB0viZdJbgBCzF6AfwSIx9UUMw7zCA0lCrvGePhmHgUvFgNxnfVfacBUuASFNJk5WFYZdji5OQJyTKPcUpv4/fxhzrqHTPpfxUN+WC1oVEVx/8B+rpxUb5ES58Bg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=F86LlFOS8CWChlGLXSohM3AdNG/FO/hsR22WuPM/HTw=; b=sU3T1FzHrctfjEnfdrv2I2djcUYYCPcFTR6IgpDjC1Inu2atNlMOy8vIZws3t+XpIg2G+TtoR6k+P2JBNYhpHI6leuZUG1CTGdx/UOLiXmVyo/HvDT9UuTt3p3KMemc7QqHkMO9NEgurtvu9JkUVXZh2aoSIiN4CD5HTT2JIn+Ca5jemIpVdn8UOFVFt8OalXKdXwKvKOqBwHVXOe1eSN1wDjqUtnHpsBGP8eR1+drAS+plaooNdOT941ZqGEdDMziHePQAbzfwEYiQLHzkVWRefuh3wumzf1YXutWCcV82u1jcIdMDFZjwtap/61SHFt0lx9pFFFIzhLPSa+urOKA== Received: from SN6PR02MB4157.namprd02.prod.outlook.com (2603:10b6:805:33::23) by CH8PR02MB10863.namprd02.prod.outlook.com (2603:10b6:610:277::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9564.16; Sun, 1 Feb 2026 19:30:29 +0000 Received: from SN6PR02MB4157.namprd02.prod.outlook.com ([fe80::900:1ccf:2b1e:52b6]) by SN6PR02MB4157.namprd02.prod.outlook.com ([fe80::900:1ccf:2b1e:52b6%6]) with mapi id 15.20.9564.016; Sun, 1 Feb 2026 19:30:29 +0000 From: Michael Kelley To: David Howells , Sami Tolvanen CC: Lukas Wunner , Ignat Korchagin , Jarkko Sakkinen , Herbert Xu , Eric Biggers , Luis Chamberlain , Petr Pavlu , Daniel Gomez , "Jason A . Donenfeld" , Ard Biesheuvel , Stephan Mueller , "linux-crypto@vger.kernel.org" , "keyrings@vger.kernel.org" , "linux-modules@vger.kernel.org" , "linux-kernel@vger.kernel.org" Subject: RE: [PATCH v15 6/7] modsign: Enable ML-DSA module signing Thread-Topic: [PATCH v15 6/7] modsign: Enable ML-DSA module signing Thread-Index: AQHcjtC3xUDRE8Ho5kej8+vCQMw4IrVsc8pggAGitACAACfKkA== Date: Sun, 1 Feb 2026 19:30:28 +0000 Message-ID: References: <20260126142931.1940586-1-dhowells@redhat.com> <20260126142931.1940586-7-dhowells@redhat.com> <2315764.1769964282@warthog.procyon.org.uk> In-Reply-To: <2315764.1769964282@warthog.procyon.org.uk> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: SN6PR02MB4157:EE_|CH8PR02MB10863:EE_ x-ms-office365-filtering-correlation-id: a028c0f6-675f-4dab-354b-08de61c85b92 x-microsoft-antispam: BCL:0;ARA:14566002|15080799012|8060799015|8062599012|8022599003|461199028|13091999003|31061999003|19110799012|3412199025|440099028|102099032; x-microsoft-antispam-message-info: =?us-ascii?Q?rUWKVB3TVoGl9879TDqv3INfB9b5DVg35WTGfwWj5F9Wos5vNVm798AwWFlS?= =?us-ascii?Q?oCxOJi26GRkYRWPUt+z9Gdoz7kHZWX6ilBH5tWVxEHiNGpvQccrpXBaCjJfR?= =?us-ascii?Q?IRiEdOiEt3fqAQ6iZUvW/EZTq7udfYCAGWFU4h6H2nhwEeLpOVROupjp9hX3?= =?us-ascii?Q?RiJDrJycOVIytoDIkwU7Nr9WqkOanYntpcs1DHRB88QpIHDqm6Be67cnL/bi?= =?us-ascii?Q?YB5cys9axnBNMfsNGXL2F9N4gH4pDtzCvzShCVkq3rTJNbF2NFe9k+XyBvVU?= =?us-ascii?Q?zgNdT/EOwcnGKZNaBqyiELHKrWhPMz65roxiztpiPxa66xc53Wb8u7cL2M1Y?= =?us-ascii?Q?NAL80RAsioL6imv8a/WsqSeMI4s3Qo7Ac3eTeGJyhHQ2gND2zf158Xvrpq32?= =?us-ascii?Q?S6M/HKxLh55sDxMHwvHylrCyHwEYDGva7uh6SbzZW6+EtPOJxC8CqEuLg31c?= =?us-ascii?Q?omeLronycGexGdeujkh5Q8N2KOdnU4zaePgOfjRPouqeBu64TeRLJyHG/JiF?= =?us-ascii?Q?KTuIWfjRL/QCl8hsAdfv8fj1ZVDCnIh1cY0+FMECmaec6J0miLhvPVA58sV1?= =?us-ascii?Q?JpPeIkCfYBnuWIoDoC0vKg3vWEW3ltcBL8TM9/LVsk3ODxRcinUWVUwHxEZD?= =?us-ascii?Q?bH9MTfEE1FjAZ5k/i3prttE+MCLog9nsVC0VirYH3h62WOyeeTHW2Ep9DVib?= =?us-ascii?Q?wbEx53nXGVctpKhkaZL1vO8oiZB5Q48/kUO8fEuimAfeUQutVyNq5g/zReIS?= =?us-ascii?Q?MhDH4ZBgI3EXbb5XiaSADJYfuf27UtSB/Co1CaY6NmUjA8nyuHPqqKN1G27M?= =?us-ascii?Q?nLWi++Etpohlk9YCKRKMcIMLoSj1Pxyb2QVnobMLGmW1FMb/hBfUqfqTJRMg?= =?us-ascii?Q?Bu3DZnZRGmZrA3OQ9NWsq2zwIB0swiR6blNziJWz1+3wlwVghNEzlxT7exlb?= =?us-ascii?Q?8c2UmLNOvhgPwLl9Bpal2otgfSE+B/g05Bl3hBjB2dnW248vK51G4Lbtefy7?= =?us-ascii?Q?n6piPXNCjsCpHsA2RdunmU6ZJa+4Rz2msMMFRIZ6nf0pILeP6rRwYqyd4HpJ?= =?us-ascii?Q?oWADK0NXgtEEv5c8A1y6YagAMvHRIcQ8af+bQstRdRshN420zHJAtnmi48DS?= =?us-ascii?Q?fMh1NKO9ZfYyBoIHbGTKI5sG9Us7mVftb+krmYtXaqMjSfVNjjmF5Ic=3D?= x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?6Yyn8jjNUSyjPl25j+YBxHJl6EWv6kPTma5BIShn2X1fwXqmbRzLzVQoEAKk?= =?us-ascii?Q?pf/XLvHQS6EmCZUNEd1UkM/fkUe6pzbNoZ9OR7ndxdfitBCHGd7DTyZmSBH0?= =?us-ascii?Q?f8a+ymSG1i8jMVpoBAW+kPh/wJq1KSHs9bGTYGlOyonAWx5ykfZyXvEl/rhX?= =?us-ascii?Q?OyoCvaLkEAb0b/Mld+nDMhEseIOTYQHHstaQXKArezzVml/L993CcAFRNcIz?= =?us-ascii?Q?qDFlzjPvU59UJvJLegNehJDGTUv/HhVU1fMxgUsE91+MIwKlHVpLqiZWdfue?= =?us-ascii?Q?sBmFph6BO4jJTmAX0npa+gkj3E7WKjUsvhOCFW4u5MrfaWKVPNSh3Urc7CDI?= =?us-ascii?Q?akdjQ2B4PDZtDYO6lTqvr+v4kBnaTfhxncp559JeQcvHTsT2leicDTTIlGYF?= =?us-ascii?Q?SsyIxJ3z0Maj6DIZWfa579c3K1Xka9KEE7Tb7RiNB7mLRELiV87TqGw5DEuQ?= =?us-ascii?Q?Sfkh9Y7G7crhwUyHELJcMnwNpSxWZQ5nGoDU4ia/8+aF+LOIXWY6KFVFAkPZ?= =?us-ascii?Q?7A1MIEVBIOTSObNLIb8QEgFAcCncHk17ldEROdNnvqY5J9/eGFqeCqfjwI+n?= =?us-ascii?Q?q9ujCbGFRmJx5gYyaPhHTV/ZpulroiQwV8NYO0R2Rzw33RDyBi0C8l2Twsyy?= =?us-ascii?Q?PbTu7dXxXSQONnSywXtvw7e99OXfDXyXZd6hEybJTuE0Cf5SGCFmpKEEDsiC?= =?us-ascii?Q?enzj+pnLlSvfPKLtZ0BvUAYqMUgjKdl2LjQnMJrILP9z60F2VFN/qn0aOJ5i?= =?us-ascii?Q?0iVZk9VC1GfRDt0NOzIksWPGrsZ6LmiVXUccRosdRp4ny+Tk8IvqqnVldLv/?= =?us-ascii?Q?A7w6eauChZcLt8VkRldjUeygeoCJ6m3GZDjXKvn91219Y5u/fYIwYKrZZRou?= =?us-ascii?Q?nEoIqgzAPPDbozK44RbkLu05v5XphOjjRm8NbIJL8+3uA1kcXV3xW4ZxRx0a?= =?us-ascii?Q?kfZgTlh6uwS5gSmqBAt3oCjPxPVerPioEv39VbBZv7cvj3zWrJRJR5rUHOH+?= =?us-ascii?Q?iTKF1TTRqni1GOyy7+R186BKxcwFlOhNkOvV76ZmeML+a3nZrvYIROWZBopR?= =?us-ascii?Q?sJS1Q9E5AF8tnh8EN+qw9VN/6+ybZfjDFoLyWF7NQqooxhP0k1Vi/XeyPsKx?= =?us-ascii?Q?BF58StZ1Gim0OSpemKDNNQY2hEjahKVLLdjHUMknaiIyDDxmsFVXIncUUK0D?= =?us-ascii?Q?zTic+TgtlKWWPSCkSadYW2h3VvPeQttjzuEYPdMdXuLiYtCmUqJXqybfeu1k?= =?us-ascii?Q?WDzLhxGRmnQbr+9Ln0f3Qd7LUPZ3PDI5ld38WkThC8piNZNT8TsdTk6941qb?= =?us-ascii?Q?2p2OJhHD66ATAg4WJQP+1nPBG+sb+ZOOQS4AB/KlWXD4smkQHNcQZTqadBmt?= =?us-ascii?Q?v2b5IcQ=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SN6PR02MB4157.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-Network-Message-Id: a028c0f6-675f-4dab-354b-08de61c85b92 X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Feb 2026 19:30:29.0698 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH8PR02MB10863 From: David Howells Sent: Sunday, February 1, 2026 8:= 45 AM >=20 > Michael Kelley wrote: >=20 > > I'm building linux-next20260130, which has this patch, and get the foll= owing errors: > > > > HOSTCC scripts/sign-file > > scripts/sign-file.c: In function 'main': > > scripts/sign-file.c:282:25: error: 'CMS_NO_SIGNING_TIME' undeclared (fi= rst use in this function) > > ... > > The problem is that I'm running on Ubuntu 20.04, with this openssl: > > > > # openssl version > > OpenSSL 1.1.1f 31 Mar 2020 >=20 > The problem probably isn't this patch, it's almost certainly due to: >=20 > d7afd65b4acc7 ("sign-file: Use only the OpenSSL CMS API for signing") >=20 > in the modules tree. It removes support for PKCS#7 signature generation. >=20 > Were you using PKCS#7 with SHA1? >=20 If I comment out code from 7ca1c9dcb7b0 as follows, sign-file.c will build.= The kernel will then build and run. I'm doing dev/test builds with no need to s= ign anything. MODULE_SIG_ALL is not set. diff --git a/scripts/sign-file.c b/scripts/sign-file.c index 5391b5b7e178..724944cf8a26 100644 --- a/scripts/sign-file.c +++ b/scripts/sign-file.c @@ -279,18 +279,15 @@ int main(int argc, char **argv) CMS_DETACHED | CMS_STREAM | CMS_NOSMIMECAP | - CMS_NO_SIGNING_TIME | + /* CMS_NO_SIGNING_TIME | */ use_keyid; - if ((EVP_PKEY_is_a(private_key, "ML-DSA-44") || +/* if ((EVP_PKEY_is_a(private_key, "ML-DSA-44") || EVP_PKEY_is_a(private_key, "ML-DSA-65") || EVP_PKEY_is_a(private_key, "ML-DSA-87")) && - OPENSSL_VERSION_MAJOR < 4) { - /* ML-DSA + CMS_NOATTR is not supported in openssl= -3.5 - * and before. - */ + OPENSSL_VERSION_MAJOR < 4) { use_signed_attrs =3D 0; - } + } */ Pardon my ignorance of the signing details, but I don't see an indication of having selected PKCS#7 with SHA1 in my .config. What am I looking for? Michael