Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #86406 > unrolled thread

Bug#1100015: In-kernel X.509 certificates fail to load since 6.13.6

Back to article view | Back to linux.debian.kernel

Contents

  Bug#1100015: In-kernel X.509 certificates fail to load since 6.13.6 Raul Tambre <raul@tambre.ee> - 2025-03-10 12:00 +0100
    Processed: In-kernel X.509 certificates fail to load since 6.13.6 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-03-10 12:00 +0100
    Bug#1100015: In-kernel X.509 certificates fail to load since 6.13.6 Bastian Blank <waldi@debian.org> - 2025-03-11 17:10 +0100
      Bug#1100015: In-kernel X.509 certificates fail to load since 6.13.6 Bastian Blank <waldi@debian.org> - 2025-03-11 17:30 +0100
    Bug#1100015: marked as done (In-kernel X.509 certificates fail to  load since 6.13.6) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-03-14 22:10 +0100

#86406 — Bug#1100015: In-kernel X.509 certificates fail to load since 6.13.6

Source: linux-signed-amd64
Version: 6.13.6-1~exp1
Severity: normal
X-Debbugs-CC: waldi@debian.org
Control: notfound -1 6.13.5-1~exp1

Starting with 6.13.6-1~exp1 the following error is logged during boot:

  Mar 10 12:11:53 laptop kernel: Loading compiled-in X.509 certificates
  Mar 10 12:11:53 laptop kernel: Problem loading in-kernel X.509 certificate (-2)

I imagine this is likely caused by commit ca3d0e60f548ed18c360fa87c5a2966606862b05 ("Store build time signing key encrypted").

[toc] | [next] | [standalone]

#86407 — Processed: In-kernel X.509 certificates fail to load since 6.13.6

Processing control commands:

> notfound -1 6.13.5-1~exp1
Bug #1100015 [src:linux-signed-amd64] In-kernel X.509 certificates fail to load since 6.13.6
The source 'linux-signed-amd64' and version '6.13.5-1~exp1' do not appear to match any binary packages
Ignoring request to alter found versions of bug #1100015 to the same values previously set

-- 
1100015: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1100015
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#86421

On Mon, Mar 10, 2025 at 12:51:35PM +0200, Raul Tambre wrote:
> Starting with 6.13.6-1~exp1 the following error is logged during boot:
> 
>   Mar 10 12:11:53 laptop kernel: Loading compiled-in X.509 certificates
>   Mar 10 12:11:53 laptop kernel: Problem loading in-kernel X.509 certificate (-2)
> 
> I imagine this is likely caused by commit ca3d0e60f548ed18c360fa87c5a2966606862b05 ("Store build time signing key encrypted").

Yeah.  And the immediate reason:

| -Signature Algorithm: sha256WithRSAEncryption
| +Signature Algorithm: ecdsa-with-SHA256

The old kernel tried to configure with ecdsa, but failed, due to some
conflicts in the config, falling back to rsa.

And missing support for ecdsa, but for some reason built-in suport for
rsa.

| root@boot1:/usr/lib/debug/boot# grep CONFIG_CRYPTO_RSA /boot/config-6.1*
| /boot/config-6.12.17-cloud-amd64:CONFIG_CRYPTO_RSA=y
| /boot/config-6.13-cloud-amd64:CONFIG_CRYPTO_RSA=y
| root@boot1:/usr/lib/debug/boot# grep CONFIG_CRYPTO_ECDS /boot/config-6.1*
| /boot/config-6.12.17-cloud-amd64:# CONFIG_CRYPTO_ECDSA is not set
| /boot/config-6.13-cloud-amd64:# CONFIG_CRYPTO_ECDSA is not set

Bastian

-- 
Knowledge, sir, should be free to all!
		-- Harry Mudd, "I, Mudd", stardate 4513.3

[toc] | [prev] | [next] | [standalone]

#86422

On Tue, Mar 11, 2025 at 05:03:43PM +0100, Bastian Blank wrote:
> On Mon, Mar 10, 2025 at 12:51:35PM +0200, Raul Tambre wrote:
> > Starting with 6.13.6-1~exp1 the following error is logged during boot:
> > 
> >   Mar 10 12:11:53 laptop kernel: Loading compiled-in X.509 certificates
> >   Mar 10 12:11:53 laptop kernel: Problem loading in-kernel X.509 certificate (-2)
> > 
> > I imagine this is likely caused by commit ca3d0e60f548ed18c360fa87c5a2966606862b05 ("Store build time signing key encrypted").

Better:

| [    0.771494] Loading compiled-in X.509 certificates
| [    0.799015] Loaded X.509 cert 'Build time autogenerated kernel key: 99d0ca786d5a994f2bcf7bd2f2f3a7767bd01a3c'

Bastian

-- 
We have found all life forms in the galaxy are capable of superior
development.
		-- Kirk, "The Gamesters of Triskelion", stardate 3211.7

[toc] | [prev] | [next] | [standalone]

#86442 — Bug#1100015: marked as done (In-kernel X.509 certificates fail to load since 6.13.6)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Fri, 14 Mar 2025 21:03:13 +0000
with message-id <E1ttCBV-003Yac-1K@fasolo.debian.org>
and subject line Bug#1100015: fixed in linux 6.13.7-1~exp1
has caused the Debian Bug report #1100015,
regarding In-kernel X.509 certificates fail to load since 6.13.6
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1100015: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1100015
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web