Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #53861 > unrolled thread

Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem'

Back to article view | Back to linux.debian.kernel

Contents

  Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem' Santiago Vila <sanvila@unex.es> - 2016-04-30 22:20 +0200
    Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem') Santiago Vila <sanvila@unex.es> - 2016-04-30 23:30 +0200
      Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem') Ben Hutchings <ben@decadent.org.uk> - 2016-04-30 23:50 +0200
        Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem') Santiago Vila <sanvila@unex.es> - 2016-05-01 00:00 +0200
          Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem') Ben Hutchings <ben@decadent.org.uk> - 2016-05-01 00:10 +0200
    Processed: Re: Bug#823107: linux: make deb-pkg fails: No rule to  make target 'debian/certs/benh@debian.org.cert.pem') owner@bugs.debian.org (Debian Bug Tracking System) - 2016-04-30 23:50 +0200

#53861 — Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem'

[Multipart message — attachments visible in raw view] — view raw

Package: src:linux
Version: 4.5.2-1

Dear maintainer:

I merged the output of "lsmod" in two different virtual machines
running stretch/sid to create a minimal kernel which works on both.

The combined file is attached as "lsmod.txt".

Then I created a .config file by executing this script:


#!/bin/sh
cd linux-source-4.5
rm -f .config
make LSMOD=../lsmod.txt localyesconfig
cp -p .config ../dot.config

The resulting file, dot.config, is also attached.


Then I tried to use upstream target, as recommended, to create a .deb
package for the kernel, using this script:


#!/bin/sh
cd linux-source-4.5
time -p make -j4 EXTRAVERSION="-qemu-amd64" KDEB_PKGVERSION=$(make kernelversion)-$(date +%Y%m%d).0 bindeb-pkg


I already did this in jessie so I expected this to work on stretch as
well, but this is what heppened:


make[3]: *** No rule to make target 'debian/certs/benh@debian.org.cert.pem', needed by 'certs/x509_certificate_list'.  Stop.
Makefile:954: recipe for target 'certs' failed
make[2]: *** [certs] Error 2
make[2]: *** Waiting for unfinished jobs....
  CHK     include/generated/compile.h
  CHK     kernel/config_data.h
scripts/package/Makefile:97: recipe for target 'bindeb-pkg' failed
make[1]: *** [bindeb-pkg] Error 2
Makefile:1255: recipe for target 'bindeb-pkg' failed
make: *** [bindeb-pkg] Error 2
Command exited with non-zero status 2


Does this mean I need your key to build a custom kernel? I hope not.

Should I remove CONFIG_SYSTEM_TRUSTED_KEYS from .config before building
the kernel? I hope not.

Maybe "make localyesconfig" should not take CONFIG_SYSTEM_TRUSTED_KEYS
from the running kernel or the linux-source package? I don't know.

To summarize: I think this should work without having to do anything
special, but currently, it does not.

Thanks.

[toc] | [next] | [standalone]

#53862 — Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem')

On Sat, Apr 30, 2016 at 08:51:25PM +0000, Debian Bug Tracking System wrote:

> You wrote:
> [...]
> > Should I remove CONFIG_SYSTEM_TRUSTED_KEYS from .config before building
> > the kernel? I hope not.
> [...]
> 
> Yes, you must do that.  Your custom kernel configuration should be
> based on the appropriate file provided in linux-source-4.5.  These have
> the CONFIG_MODULE_SIG_ALL, CONFIG_MODULE_SIG_KEY and
> CONFIG_SYSTEM_TRUSTED_KEYS settings removed so that custom kernels will
> get modules signed by a one-time key.

If I have to remove CONFIG_SYSTEM_TRUSTED_KEYS by hand, then
documentation is wrong.

This is from README, which is included in linux-source-4.5:


     "make localmodconfig" Create a config based on current config and
                           loaded modules (lsmod). Disables any module
                           option that is not needed for the loaded modules.

============>              To create a localmodconfig for another machine,
                           store the lsmod of that machine into a file
                           and pass it in as a LSMOD parameter.

                   target$ lsmod > /tmp/mylsmod
                   target$ scp /tmp/mylsmod host:/tmp

                   host$ make LSMOD=/tmp/mylsmod localmodconfig

                           The above also works when cross compiling.


So, this recipe is no longer valid.

How is this not a documentation bug?

[toc] | [prev] | [next] | [standalone]

#53864 — Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem')

[Multipart message — attachments visible in raw view] — view raw

Control: reopen -1
Control: retitle -1 local{mod,yes}config should fix references to unavailable certificates
Control: tag -1 upstream

On Sat, 2016-04-30 at 23:24 +0200, Santiago Vila wrote:
> On Sat, Apr 30, 2016 at 08:51:25PM +0000, Debian Bug Tracking System wrote:
> 
> > 
> > You wrote:
> > [...]
> > > 
> > > Should I remove CONFIG_SYSTEM_TRUSTED_KEYS from .config before building
> > > the kernel? I hope not.
> > [...]
> > 
> > Yes, you must do that.  Your custom kernel configuration should be
> > based on the appropriate file provided in linux-source-4.5.  These have
> > the CONFIG_MODULE_SIG_ALL, CONFIG_MODULE_SIG_KEY and
> > CONFIG_SYSTEM_TRUSTED_KEYS settings removed so that custom kernels will
> > get modules signed by a one-time key.
> If I have to remove CONFIG_SYSTEM_TRUSTED_KEYS by hand, then
> documentation is wrong.
[...]

Oh, I see the problem.  I didn't realise that the local{mod,yes}config
rules would (a) copy the config file from /boot or (b) keep the keyring
config symbols unchanged.

Ben.

-- 
Ben Hutchings
Tomorrow will be cancelled due to lack of interest.

[toc] | [prev] | [next] | [standalone]

#53866 — Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem')

On Sat, Apr 30, 2016 at 11:41:09PM +0200, Ben Hutchings wrote:
> > > Yes, you must do that.  Your custom kernel configuration should be
> > > based on the appropriate file provided in linux-source-4.5.  These have
> > > the CONFIG_MODULE_SIG_ALL, CONFIG_MODULE_SIG_KEY and
> > > CONFIG_SYSTEM_TRUSTED_KEYS settings removed so that custom kernels will
> > > get modules signed by a one-time key.
> > If I have to remove CONFIG_SYSTEM_TRUSTED_KEYS by hand, then
> > documentation is wrong.
> [...]
> 
> Oh, I see the problem.  I didn't realise that the local{mod,yes}config
> rules would (a) copy the config file from /boot or (b) keep the keyring
> config symbols unchanged.

Thanks a lot!


I have a related question: I know that you spent some time making
linux-image build reproducible. If by way of this module signing thing
the linux-image distributed by Debian is based on your key, does this
not make the build unreproducible again?

[toc] | [prev] | [next] | [standalone]

#53867 — Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem')

[Multipart message — attachments visible in raw view] — view raw

On Sat, 2016-04-30 at 23:52 +0200, Santiago Vila wrote:
> On Sat, Apr 30, 2016 at 11:41:09PM +0200, Ben Hutchings wrote:
> > 
> > > 
> > > > 
> > > > Yes, you must do that.  Your custom kernel configuration should be
> > > > based on the appropriate file provided in linux-source-4.5.  These have
> > > > the CONFIG_MODULE_SIG_ALL, CONFIG_MODULE_SIG_KEY and
> > > > CONFIG_SYSTEM_TRUSTED_KEYS settings removed so that custom kernels will
> > > > get modules signed by a one-time key.
> > > If I have to remove CONFIG_SYSTEM_TRUSTED_KEYS by hand, then
> > > documentation is wrong.
> > [...]
> > 
> > Oh, I see the problem.  I didn't realise that the local{mod,yes}config
> > rules would (a) copy the config file from /boot or (b) keep the keyring
> > config symbols unchanged.
> Thanks a lot!
> 
> 
> I have a related question: I know that you spent some time making
> linux-image build reproducible. If by way of this module signing thing
> the linux-image distributed by Debian is based on your key, does this
> not make the build unreproducible again?

The official packages are still reproducible.  See
<https://www.decadent.org.uk/ben/talks/secure-boot-linux-package.pdf>

Ben.

-- 
Ben Hutchings
73.46% of all statistics are made up.

[toc] | [prev] | [next] | [standalone]

#53865 — Processed: Re: Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem')

Processing control commands:

> reopen -1
Bug #823107 {Done: Ben Hutchings <ben@decadent.org.uk>} [src:linux] linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem'
Bug reopened
Ignoring request to alter fixed versions of bug #823107 to the same values previously set
> retitle -1 local{mod,yes}config should fix references to unavailable certificates
Bug #823107 [src:linux] linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem'
Changed Bug title to 'local{mod,yes}config should fix references to unavailable certificates' from 'linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem''.
> tag -1 upstream
Bug #823107 [src:linux] local{mod,yes}config should fix references to unavailable certificates
Added tag(s) upstream.

-- 
823107: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823107
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web