* Building signed debs @ 2023-12-08 11:14 Tom Cook 2023-12-08 12:06 ` Bagas Sanjaya 2023-12-09 18:17 ` Masahiro Yamada 0 siblings, 2 replies; 6+ messages in thread From: Tom Cook @ 2023-12-08 11:14 UTC (permalink / raw) To: LKML I'm trying to build a signed .deb kernel package of https://github.com/torvalds/linux/tree/v6.6. I've copied certs/default_x509.genkey to certs/x509.genkey. The .config is the one from Ubuntu 23.10's default kernel with all new options accepted at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and CONFIG_SYSTEM_REVOCATION_KEYS="". This builds the kernel and modules, signs the modules, compresses the modules and then attempts to sign the modules again. That fails, because the .ko module files are now .ko.zst files and the file it's trying to sign isn't there. Full failure is pasted below. Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable module compression). Is there a way to build a .deb of a signed kernel with compressed modules? Thanks for any help, Tom INSTALL debian/linux-libc-dev/usr/include SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko At main.c:298: - SSL error:FFFFFFFF80000002:system library::No such file or directory: ../crypto/bio/bss_file.c:67 - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75 sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko At main.c:298: - SSL error:FFFFFFFF80000002:system library::No such file or directory: ../crypto/bio/bss_file.c:67 - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75 sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko make[6]: *** [scripts/Makefile.modinst:137: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko] Error 1 make[6]: *** Waiting for unfinished jobs.... make[6]: *** [scripts/Makefile.modinst:137: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko] Error 1 SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko At main.c:298: - SSL error:FFFFFFFF80000002:system library::No such file or directory: ../crypto/bio/bss_file.c:67 - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75 sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko make[6]: *** [scripts/Makefile.modinst:137: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko] Error 1 At main.c:298: - SSL error:FFFFFFFF80000002:system library::No such file or directory: ../crypto/bio/bss_file.c:67 - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75 sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko make[6]: *** [scripts/Makefile.modinst:137: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko] Error 1 At main.c:298: - SSL error:FFFFFFFF80000002:system library::No such file or directory: ../crypto/bio/bss_file.c:67 - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75 sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko make[6]: *** [scripts/Makefile.modinst:137: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko] Error 1 make[5]: *** [Makefile:1821: modules_install] Error 2 make[4]: *** [Makefile:2036: run-command] Error 2 make[3]: *** [debian/rules:17: binary-arch] Error 2 dpkg-buildpackage: error: make -f debian/rules binary subprocess returned exit status 2 make[2]: *** [scripts/Makefile.package:146: bindeb-pkg] Error 2 make[1]: *** [/home/tkcook/git/linux/v6.6/Makefile:1538: bindeb-pkg] Error 2 make: *** [Makefile:234: __sub-make] Error 2 ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Building signed debs 2023-12-08 11:14 Building signed debs Tom Cook @ 2023-12-08 12:06 ` Bagas Sanjaya 2023-12-11 10:24 ` Tom Cook 2023-12-09 18:17 ` Masahiro Yamada 1 sibling, 1 reply; 6+ messages in thread From: Bagas Sanjaya @ 2023-12-08 12:06 UTC (permalink / raw) To: Tom Cook, Linux Kernel Mailing List, Linux Kernel Build System, Linux Crypto API Cc: Masahiro Yamada, Herbert Xu, David S. Miller, Nick Terrell [-- Attachment #1: Type: text/plain, Size: 2000 bytes --] On Fri, Dec 08, 2023 at 11:14:35AM +0000, Tom Cook wrote: > I'm trying to build a signed .deb kernel package of > https://github.com/torvalds/linux/tree/v6.6. I've copied > certs/default_x509.genkey to certs/x509.genkey. The .config is the > one from Ubuntu 23.10's default kernel with all new options accepted > at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and > CONFIG_SYSTEM_REVOCATION_KEYS="". > > This builds the kernel and modules, signs the modules, compresses the > modules and then attempts to sign the modules again. That fails, > because the .ko module files are now .ko.zst files and the file it's > trying to sign isn't there. Full failure is pasted below. > > Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable > module compression). > Seriously? Unrelated option becomes a workaround? > Is there a way to build a .deb of a signed kernel with compressed modules? > > Thanks for any help, > Tom > > INSTALL debian/linux-libc-dev/usr/include > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko > At main.c:298: > - SSL error:FFFFFFFF80000002:system library::No such file or > directory: ../crypto/bio/bss_file.c:67 Above means that you don't have a valid certificate/keypair set in CONFIG_MODULE_SIG_KEY. If you keep the option value on `certs/signing_key.pem` (which is the default), the key should be automatically generated (with your observation, only if `certs/x509.genkey` doesn't already exist). After building the kernel with `make all`, you should check if the certificate pointed in CONFIG_MODULE_SIG_KEY is present or not. If it isn't the case, you have to generate the certificate yourself. For more information, see Documentation/admin-guide/module.signing.rst in the kernel sources. Thanks. -- An old man doll... just what I always wanted! - Clara [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 228 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Building signed debs 2023-12-08 12:06 ` Bagas Sanjaya @ 2023-12-11 10:24 ` Tom Cook 0 siblings, 0 replies; 6+ messages in thread From: Tom Cook @ 2023-12-11 10:24 UTC (permalink / raw) To: Bagas Sanjaya Cc: Linux Kernel Mailing List, Linux Kernel Build System, Linux Crypto API, Masahiro Yamada, Herbert Xu, David S. Miller, Nick Terrell On Fri, Dec 8, 2023 at 12:06 PM Bagas Sanjaya <bagasdotme@gmail.com> wrote: > On Fri, Dec 08, 2023 at 11:14:35AM +0000, Tom Cook wrote: > > Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable > > module compression). > > > > Seriously? Unrelated option becomes a workaround? "Workaround" as in "With this options set, `make deb-pkg` crashes out with the reported error, while with this option unset it produces a deb package of a signed kernel and modules." This looks like a defect in the build system to me and the workaround allows me to build a package in the meantime. > > Is there a way to build a .deb of a signed kernel with compressed modules? > > > > Thanks for any help, > > Tom > > > > INSTALL debian/linux-libc-dev/usr/include > > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko > > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko > > At main.c:298: > > - SSL error:FFFFFFFF80000002:system library::No such file or > > directory: ../crypto/bio/bss_file.c:67 > > Above means that you don't have a valid certificate/keypair set in > CONFIG_MODULE_SIG_KEY. If you keep the option value on `certs/signing_key.pem` > (which is the default), the key should be automatically generated > (with your observation, only if `certs/x509.genkey` doesn't already exist). > After building the kernel with `make all`, you should check if the certificate > pointed in CONFIG_MODULE_SIG_KEY is present or not. If it isn't the case, > you have to generate the certificate yourself. For more information, see > Documentation/admin-guide/module.signing.rst in the kernel sources. Sorry for being unclear - I'm not building with `make all`, I'm building with `make deb-pkg`. If I had to guess, I'd say the .deb depends on the uncompressed modules rather than the dependency depending on whether module compression is turned on or not, but it's only a guess. Regards, Tom ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Building signed debs 2023-12-08 11:14 Building signed debs Tom Cook 2023-12-08 12:06 ` Bagas Sanjaya @ 2023-12-09 18:17 ` Masahiro Yamada 2023-12-11 10:19 ` Tom Cook 1 sibling, 1 reply; 6+ messages in thread From: Masahiro Yamada @ 2023-12-09 18:17 UTC (permalink / raw) To: Tom Cook, linux-modules; +Cc: LKML On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <tom.k.cook@gmail.com> wrote: > > I'm trying to build a signed .deb kernel package of > https://github.com/torvalds/linux/tree/v6.6. I've copied > certs/default_x509.genkey to certs/x509.genkey. The .config is the > one from Ubuntu 23.10's default kernel with all new options accepted > at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and > CONFIG_SYSTEM_REVOCATION_KEYS="". > > This builds the kernel and modules, signs the modules, compresses the > modules and then attempts to sign the modules again. That fails, > because the .ko module files are now .ko.zst files and the file it's > trying to sign isn't there. Full failure is pasted below. Modules are signed before the compression. Once you compress modules, you cannot re-sign them again unless you decompress modules, sign them, and compress them again. Now, the kernel can directly load compressed modules, so perhaps allowing users to sign compressed modules might be beneficial. (that is, reverse the order of singing and compression) I am not sure whether it is possible or not, though. I added linux-modules ML. > > Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable > module compression). > > Is there a way to build a .deb of a signed kernel with compressed modules? > > Thanks for any help, > Tom > > INSTALL debian/linux-libc-dev/usr/include > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko > At main.c:298: > - SSL error:FFFFFFFF80000002:system library::No such file or > directory: ../crypto/bio/bss_file.c:67 > - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75 > sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko > At main.c:298: > - SSL error:FFFFFFFF80000002:system library::No such file or > directory: ../crypto/bio/bss_file.c:67 > - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75 > sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko > make[6]: *** [scripts/Makefile.modinst:137: > debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko] > Error 1 > make[6]: *** Waiting for unfinished jobs.... > make[6]: *** [scripts/Makefile.modinst:137: > debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko] > Error 1 > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko > At main.c:298: > - SSL error:FFFFFFFF80000002:system library::No such file or > directory: ../crypto/bio/bss_file.c:67 > - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75 > sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko > make[6]: *** [scripts/Makefile.modinst:137: > debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko] > Error 1 > At main.c:298: > - SSL error:FFFFFFFF80000002:system library::No such file or > directory: ../crypto/bio/bss_file.c:67 > - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75 > sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko > make[6]: *** [scripts/Makefile.modinst:137: > debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko] > Error 1 > At main.c:298: > - SSL error:FFFFFFFF80000002:system library::No such file or > directory: ../crypto/bio/bss_file.c:67 > - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75 > sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko > make[6]: *** [scripts/Makefile.modinst:137: > debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko] > Error 1 > make[5]: *** [Makefile:1821: modules_install] Error 2 > make[4]: *** [Makefile:2036: run-command] Error 2 > make[3]: *** [debian/rules:17: binary-arch] Error 2 > dpkg-buildpackage: error: make -f debian/rules binary subprocess > returned exit status 2 > make[2]: *** [scripts/Makefile.package:146: bindeb-pkg] Error 2 > make[1]: *** [/home/tkcook/git/linux/v6.6/Makefile:1538: bindeb-pkg] Error 2 > make: *** [Makefile:234: __sub-make] Error 2 -- Best Regards Masahiro Yamada ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Building signed debs 2023-12-09 18:17 ` Masahiro Yamada @ 2023-12-11 10:19 ` Tom Cook 2023-12-11 18:15 ` Masahiro Yamada 0 siblings, 1 reply; 6+ messages in thread From: Tom Cook @ 2023-12-11 10:19 UTC (permalink / raw) To: Masahiro Yamada; +Cc: linux-modules, LKML On Sat, Dec 9, 2023 at 6:18 PM Masahiro Yamada <masahiroy@kernel.org> wrote: > On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <tom.k.cook@gmail.com> wrote: > > > > I'm trying to build a signed .deb kernel package of > > https://github.com/torvalds/linux/tree/v6.6. I've copied > > certs/default_x509.genkey to certs/x509.genkey. The .config is the > > one from Ubuntu 23.10's default kernel with all new options accepted > > at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and > > CONFIG_SYSTEM_REVOCATION_KEYS="". > > > > This builds the kernel and modules, signs the modules, compresses the > > modules and then attempts to sign the modules again. That fails, > > because the .ko module files are now .ko.zst files and the file it's > > trying to sign isn't there. Full failure is pasted below. > > > > Modules are signed before the compression. Reading back through my earlier email, I wasn't clear that when I said "This builds the kernel..." I meant "`make deb-pkg` builds the kernel". I'm not doing anything outlandish here, I think, just expecting the build system to work. Regards, Tom ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Building signed debs 2023-12-11 10:19 ` Tom Cook @ 2023-12-11 18:15 ` Masahiro Yamada 0 siblings, 0 replies; 6+ messages in thread From: Masahiro Yamada @ 2023-12-11 18:15 UTC (permalink / raw) To: Tom Cook; +Cc: linux-modules, LKML On Mon, Dec 11, 2023 at 7:19 PM Tom Cook <tom.k.cook@gmail.com> wrote: > > On Sat, Dec 9, 2023 at 6:18 PM Masahiro Yamada <masahiroy@kernel.org> wrote: > > On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <tom.k.cook@gmail.com> wrote: > > > > > > I'm trying to build a signed .deb kernel package of > > > https://github.com/torvalds/linux/tree/v6.6. I've copied > > > certs/default_x509.genkey to certs/x509.genkey. The .config is the > > > one from Ubuntu 23.10's default kernel with all new options accepted > > > at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and > > > CONFIG_SYSTEM_REVOCATION_KEYS="". > > > > > > This builds the kernel and modules, signs the modules, compresses the > > > modules and then attempts to sign the modules again. That fails, > > > because the .ko module files are now .ko.zst files and the file it's > > > trying to sign isn't there. Full failure is pasted below. > > > > > > > > Modules are signed before the compression. > > Reading back through my earlier email, I wasn't clear that when I said "This > builds the kernel..." I meant "`make deb-pkg` builds the kernel". I'm not > doing anything outlandish here, I think, just expecting the build system to > work. > > Regards, > Tom OK, I understood. The error is caused by the following lines in scripts/package/builddeb: # re-sign stripped modules if is_enabled CONFIG_MODULE_SIG_ALL; then ${MAKE} -f ${srctree}/Makefile INSTALL_MOD_PATH="${image_pdir}" modules_sign fi The error happens when all of the following three are enabled. - CONFIG_DEBUG_INFO - CONFIG_MODULE_SIG_ALL - CONFIG_MODULE_COMPRESS_* If you disable one of them, you can do deb-pkg. -- Best Regards Masahiro Yamada ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-12-11 18:16 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2023-12-08 11:14 Building signed debs Tom Cook 2023-12-08 12:06 ` Bagas Sanjaya 2023-12-11 10:24 ` Tom Cook 2023-12-09 18:17 ` Masahiro Yamada 2023-12-11 10:19 ` Tom Cook 2023-12-11 18:15 ` Masahiro Yamada
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®