Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #54392 > unrolled thread

Bug#826959: linux-signed is not yet suitable for testing

Back to article view | Back to linux.debian.kernel

Contents

  Bug#826959: linux-signed is not yet suitable for testing Ben Hutchings <ben@decadent.org.uk> - 2016-06-10 18:00 +0200
    Bug#826959: linux-signed is not yet suitable for testing Luca Boccassi <luca.boccassi@gmail.com> - 2017-01-23 13:10 +0100
      Bug#826959: linux-signed is not yet suitable for testing Luca Boccassi <lboccass@Brocade.com> - 2017-01-23 15:20 +0100
        Bug#826959: linux-signed is not yet suitable for testing Ben Hutchings <ben@decadent.org.uk> - 2017-01-23 16:10 +0100
          Bug#826959: linux-signed is not yet suitable for testing Luca Boccassi <luca.boccassi@gmail.com> - 2017-01-23 17:00 +0100
      Bug#826959: linux-signed is not yet suitable for testing Ben Hutchings <ben@decadent.org.uk> - 2017-01-23 16:00 +0100
        Bug#826959: linux-signed is not yet suitable for testing Luca Boccassi <luca.boccassi@gmail.com> - 2017-01-23 16:50 +0100
    Bug#826959: marked as done (linux-signed is not yet suitable for  testing) owner@bugs.debian.org (Debian Bug Tracking System) - 2017-05-20 01:30 +0200

#54392 — Bug#826959: linux-signed is not yet suitable for testing

Package: src:linux-signed
Version: 1.1
Severity: serious

Several changes are needed before it's ready for release:

1. Building signed udebs
2. Removing the -signed suffix from signed image packages
3. Signing with an HSM

Ben.

-- System Information:
Debian Release: stretch/sid
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'unstable'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

[toc] | [next] | [standalone]

#56693

[Multipart message — attachments visible in raw view] — view raw

On Fri, 02 Sep 2016 16:54:10 +0100 Ben Hutchings <ben@decadent.org.uk> wrote:
> Control: severity -1 important
> 
> On Fri, 10 Jun 2016 16:55:43 +0100 Ben Hutchings <ben@decadent.org.uk>
> wrote:
> > Package: src:linux-signed
> > Version: 1.1
> > Severity: serious
> >Â 
> > Several changes are needed before it's ready for release:
> >Â 
> > 1. Building signed udebs
> > 2. Removing the -signed suffix from signed image packages
> 
> These are now done as of version 2.2.
> 
> > 3. Signing with an HSM
> 
> This is not, and it really should be, but I think we can't treat this
> as a blocker for testing propagation.
> 
> Ben.

Hello Ben,

I've done some minor changes to add flags to use pesign which supports
hardware tokens via PKCS11. Inline patch for review.

Fortunately kbuild's sign-file already supports just passing a PKCS11
URI, which makes it so much simpler. On the other hand as you most
likely have found out already pesign needs an NSS DB and cert nicknames
and tokens, and all in all it's a really awkward API to use, but that's
what we have to work with I suppose.

What do you think?

Thanks!

Kind regards,
Luca Boccassi

From d41492d4b7ee9c76973a644eb66a4be14d30335d Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Mon, 23 Jan 2017 11:59:38 +0000
Subject: [PATCH] Add support for pesign

As an alternative signing method add options to use pesign instead of
sbsign. pesign supports, among other things pkcs11 which means
support for hardware tokens.
---
 debian/README.source |  9 ++++++++-
 debian/bin/sign.py   | 35 +++++++++++++++++++++++++++++------
 debian/rules         |  2 +-
 debian/rules.defs    |  6 ++++++
 4 files changed, 44 insertions(+), 8 deletions(-)

diff --git a/debian/README.source b/debian/README.source
index 9a9b873..ed7c1b1 100644
--- a/debian/README.source
+++ b/debian/README.source
@@ -29,7 +29,7 @@ To generate the signatures:
    - KERNEL_IMAGE_VERSION: Version of the linux-image packages to be
      signed.
    - KERNEL_MODULES_PRIVKEY: Name of the private key file (RSA PEM
-     format) for module signing.
+     format) for module signing, or PKCS11 URI.
    - KERNEL_MODULES_CERT: Name of the certificate file (X.509 PEM
      format) for module signing.  This file must also be included in
      src:linux and listed in CONFIG_SYSTEM_TRUSTED_KEYS.
@@ -38,9 +38,16 @@ To generate the signatures:
    - KERNEL_IMAGE_CERT: Name of the certificate file (X.509 PEM
      format) for image signing.  This certificate must be trusted by
      the boot loader for Secure Boot to work.
+     When using pesign, this will be used as the certificate NSS
+     nickname.
    - MIRROR_SUITE: Suite from which to download the linux-image
      packages, if they are not already provided in
      debian/localpackages.
+   - SIGNER: default is sbsign, supports pesign too.
+   - NSS_DIR: if using pesign, points to the NSS database directory.
+   - NSS_TOKEN: if using pesign with an hardware token, represents the
+     token as it is known by NSS. Can be found out with:
+     modutil -dbdir sql:`${NSS_DIR}` -list
 2. If the packages are not yet publicly available (e.g. for a security
    update), create debian/localpackages/ and copy or link them into
    there.
diff --git a/debian/bin/sign.py b/debian/bin/sign.py
index 5ac3848..87c9310 100755
--- a/debian/bin/sign.py
+++ b/debian/bin/sign.py
@@ -170,8 +170,22 @@ def sign_image_efi(image_name, signature_name, privkey_name, cert_name):
     if not os.path.isfile(signature_name):
         raise Exception('sbsign failed')
 
+def sign_image_efi_pesign(image_name, signature_name, nss_dir, cert_name,
+                          nss_token=""):
+    print('I: Signing image %s' % image_name)
+    print('I: Storing detached signature as %s' % signature_name)
+    os.makedirs(os.path.dirname(signature_name), exist_ok=True)
+    subprocess.check_call(['pesign', '-s', '-n', nss_dir, '-c', cert_name,
+                           '--export-signature', signature_name,
+                           '-i', image_name] +
+                           ([] if len(nss_token) == 0 else ['-t', nss_token]))
+    # Work around bug #819987
+    if not os.path.isfile(signature_name):
+        raise Exception('pesign failed')
+
 def sign(config_name, imageversion_str, modules_privkey_name, modules_cert_name,
-         image_privkey_name, image_cert_name, mirror_url, suite):
+         image_privkey_name, image_cert_name, mirror_url, suite, signer='sbsign',
+         nss_dir=None, nss_token=""):
     config = ConfigCoreDump(fp=open(config_name, 'rb'))
 
     # Check current linux-support version
@@ -228,11 +242,20 @@ def sign(config_name, imageversion_str, modules_privkey_name, modules_cert_name,
                     kconfig = kconfig_file.readlines()
                 if ('CONFIG_EFI_STUB=y\n' in kconfig and
                     'CONFIG_EFI_SECURE_BOOT_SECURELEVEL=y\n' in kconfig):
-                    sign_image_efi('%s/boot/vmlinuz-%s' %
-                                   (package_dir, kernelversion),
-                                   '%s/boot/vmlinuz-%s.sig' %
-                                   (signature_dir, kernelversion),
-                                   image_privkey_name, image_cert_name)
+                    if signer == 'sbsign':
+                        sign_image_efi('%s/boot/vmlinuz-%s' %
+                                       (package_dir, kernelversion),
+                                       '%s/boot/vmlinuz-%s.sig' %
+                                       (signature_dir, kernelversion),
+                                       image_privkey_name, image_cert_name)
+                    elif signer == 'pesign':
+                        sign_image_efi_pesign('%s/boot/vmlinuz-%s' %
+                                       (package_dir, kernelversion),
+                                       '%s/boot/vmlinuz-%s.sig' %
+                                       (signature_dir, kernelversion),
+                                       nss_dir, image_cert_name, nss_token)
+                    else:
+                        raise Exception('unknown signer')
 
     print('Signatures should be committed: git add debian/signatures && git commit')
 
diff --git a/debian/rules b/debian/rules
index f960b3e..dd4aa40 100755
--- a/debian/rules
+++ b/debian/rules
@@ -65,6 +65,6 @@ maintainerclean:
 	rm -rf debian/control debian/control.md5sum debian/linux-* debian/rules.gen debian/localpackages debian/*-modules-*-di* debian/kernel-image-*-di*
 
 sign:
-	$(SIGN) /usr/src/linux-support-$(KERNEL_ABINAME) "$(KERNEL_IMAGE_VERSION)" "$(KERNEL_MODULES_PRIVKEY)" "$(KERNEL_MODULES_CERT)" "$(KERNEL_IMAGE_PRIVKEY)" "$(KERNEL_IMAGE_CERT)" "$(MIRROR_URL)" "$(MIRROR_SUITE)"
+	$(SIGN) /usr/src/linux-support-$(KERNEL_ABINAME) "$(KERNEL_IMAGE_VERSION)" "$(KERNEL_MODULES_PRIVKEY)" "$(KERNEL_MODULES_CERT)" "$(KERNEL_IMAGE_PRIVKEY)" "$(KERNEL_IMAGE_CERT)" "$(MIRROR_URL)" "$(MIRROR_SUITE)" "$(SIGNER)" "$(NSS_DIR)" "$(NSS_TOKEN)"
 
 .PHONY: build build-arch build-indep clean binary binary-arch binary-indep binary-arch-all maintainerclean sign
diff --git a/debian/rules.defs b/debian/rules.defs
index 8842bfb..548a1c9 100644
--- a/debian/rules.defs
+++ b/debian/rules.defs
@@ -5,6 +5,12 @@ KERNEL_ABINAME := 4.9.0-1
 KERNEL_IMAGE_VERSION := 4.9.2-2
 # Note: any version suffix must sort *lower* than +deb
 SIGNED_VERSION_SUFFIX :=
+# sbsign (default) or pesign
+SIGNER := pesign
+# when using pesign, points to the NSS DB that holds the certs
+NSS_DIR :=
+# to be used with pesign to make use of a hardware token
+NSS_TOKEN :=
 
 MIRROR_URL = http://deb.debian.org/debian/
 MIRROR_SUITE = unstable
-- 
2.1.4

[toc] | [prev] | [next] | [standalone]

#56696

[Multipart message — attachments visible in raw view] — view raw

On Mon, 23 Jan 2017 12:02:04 +0000 Luca Boccassi <luca.boccassi@gmail.com> wrote:
> On Fri, 02 Sep 2016 16:54:10 +0100 Ben Hutchings <ben@decadent.org.uk> wrote:
> > Control: severity -1 important
> > 
> > On Fri, 10 Jun 2016 16:55:43 +0100 Ben Hutchings <ben@decadent.org.uk>
> > wrote:
> > > Package: src:linux-signed
> > > Version: 1.1
> > > Severity: serious
> > >Â 
> > > Several changes are needed before it's ready for release:
> > >Â 
> > > 1. Building signed udebs
> > > 2. Removing the -signed suffix from signed image packages
> > 
> > These are now done as of version 2.2.
> > 
> > > 3. Signing with an HSM
> > 
> > This is not, and it really should be, but I think we can't treat this
> > as a blocker for testing propagation.
> > 
> > Ben.
> 
> Hello Ben,
> 
> I've done some minor changes to add flags to use pesign which supports
> hardware tokens via PKCS11. Inline patch for review.
> 
> Fortunately kbuild's sign-file already supports just passing a PKCS11
> URI, which makes it so much simpler. On the other hand as you most
> likely have found out already pesign needs an NSS DB and cert nicknames
> and tokens, and all in all it's a really awkward API to use, but that's
> what we have to work with I suppose.
> 
> What do you think?
> 
> Thanks!
> 
> Kind regards,
> Luca Boccassi

And as a followup, the build-time change to attach using pesign. The
build-dependency is generated based on rules.defs.

Thanks!

Kind regards,
Luca Boccassi

From 85f0fa32b76566139e69efa2511b782e1a3b8d3d Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Mon, 23 Jan 2017 13:34:05 +0000
Subject: [PATCH] Add support for pesign to attach signatures at build-time

Generate the build-dependency according to the SIGNER variable in
rules.defs and use the right tool in debian/rules.real.
pesign does not support attaching signatures in-place so a copy of
the binary has to be taken and then removed.
---
 debian/bin/gencontrol.py           |  9 +++++++--
 debian/rules                       |  2 +-
 debian/rules.real                  | 11 +++++++++--
 debian/templates/control.source.in |  2 +-
 4 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/debian/bin/gencontrol.py b/debian/bin/gencontrol.py
index 991a22d..cbbf2da 100755
--- a/debian/bin/gencontrol.py
+++ b/debian/bin/gencontrol.py
@@ -12,7 +12,7 @@ from debian_linux.utils import Templates, read_control
 import os.path, re, codecs, io, subprocess
 
 class Gencontrol(Base):
-    def __init__(self, config, image_version, signed_version_suffix):
+    def __init__(self, config, image_version, signed_version_suffix, signer=''):
         super(Gencontrol, self).__init__(ConfigCoreDump(fp = open(config, "rb")), Templates(["debian/templates"]))
 
         config_entry = self.config['version',]
@@ -21,6 +21,10 @@ class Gencontrol(Base):
         # Check current linux-support version
         assert self.version.complete == re.sub(r'\+b\d+$', r'', image_version)
 
+        if len(signer) == 0 or signer == 'sbsign':
+            self.signer_package = 'sbsigntool'
+        else:
+            self.signer_package = signer
         self.abiname = config_entry['abiname']
         self.binary_version = image_version + signed_version_suffix
         self.vars = {
@@ -31,6 +35,7 @@ class Gencontrol(Base):
             'imageversion': image_version,
             'imagesourceversion': self.version.complete,
             'binaryversion': self.binary_version,
+            'signer_package': self.signer_package,
         }
 
     def _substitute_file(self, template, vars, target, append=False):
@@ -141,4 +146,4 @@ class Gencontrol(Base):
                                   (vars['abiname'], vars['localversion'], name))
 
 if __name__ == '__main__':
-    Gencontrol(sys.argv[1] + "/config.defines.dump", sys.argv[2], sys.argv[3])()
+    Gencontrol(sys.argv[1] + "/config.defines.dump", sys.argv[2], sys.argv[3], sys.argv[4])()
diff --git a/debian/rules b/debian/rules
index dd4aa40..72fcd2b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -43,7 +43,7 @@ endif
 
 debian/control-real: $(GENCONTROL) $(CONTROL_FILES)
 	dpkg --compare-versions '$(KERNEL_IMAGE_VERSION)$(SIGNED_VERSION_SUFFIX)' lt '$(KERNEL_IMAGE_VERSION)+deb'
-	$(GENCONTROL) /usr/src/linux-support-$(KERNEL_ABINAME) $(KERNEL_IMAGE_VERSION) '$(SIGNED_VERSION_SUFFIX)'
+	$(GENCONTROL) /usr/src/linux-support-$(KERNEL_ABINAME) $(KERNEL_IMAGE_VERSION) '$(SIGNED_VERSION_SUFFIX)' "$(SIGNER)"
 	md5sum $^ > debian/control.md5sum
 	@echo
 	@echo This target is made to fail intentionally, to make sure
diff --git a/debian/rules.real b/debian/rules.real
index 8632121..98cbcb7 100644
--- a/debian/rules.real
+++ b/debian/rules.real
@@ -15,9 +15,16 @@ install-signed:
 	mkdir -p $(PACKAGE_DIR)/boot
 	rsync -a $(patsubst %,/boot/%-$(KERNEL_VERSION),config System.map $(IMAGE_INSTALL_STEM)) \
 		$(PACKAGE_DIR)/boot/
+# pesign does not support in-place signature attaching
 	if [ -f $(SIGNATURE_DIR)/boot/vmlinuz-$(KERNEL_VERSION).sig ]; then \
-		sbattach --attach $(SIGNATURE_DIR)/boot/vmlinuz-$(KERNEL_VERSION).sig \
-			$(PACKAGE_DIR)/boot/vmlinuz-$(KERNEL_VERSION); \
+		if [ "$(SIGNER)" = "pesign" ]; then \
+			mv $(PACKAGE_DIR)/boot/vmlinuz-$(KERNEL_VERSION) $(PACKAGE_DIR)/boot/vmlinuz-$(KERNEL_VERSION).unsigned; \
+			pesign --import-signed-certificate $(SIGNATURE_DIR)/boot/vmlinuz-$(KERNEL_VERSION).sig -i $(PACKAGE_DIR)/boot/vmlinuz-$(KERNEL_VERSION).unsigned -o $(PACKAGE_DIR)/boot/vmlinuz-$(KERNEL_VERSION); \
+			rm -f $(PACKAGE_DIR)/boot/vmlinuz-$(KERNEL_VERSION).unsigned; \
+		else \
+			sbattach --attach $(SIGNATURE_DIR)/boot/vmlinuz-$(KERNEL_VERSION).sig \
+				$(PACKAGE_DIR)/boot/vmlinuz-$(KERNEL_VERSION); \
+		fi; \
 		echo >> debian/$(PACKAGE_NAME).substvars 'signed:Description=The kernel image and modules are signed for use with Secure Boot.'; \
 	else \
 		echo >> debian/$(PACKAGE_NAME).substvars 'signed:Description=The modules are signed.'; \
diff --git a/debian/templates/control.source.in b/debian/templates/control.source.in
index c52fbe7..16ece64 100644
--- a/debian/templates/control.source.in
+++ b/debian/templates/control.source.in
@@ -4,7 +4,7 @@ Priority: optional
 Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
 Uploaders: Ben Hutchings <ben@decadent.org.uk>
 Standards-Version: 3.9.6
-Build-Depends: debhelper (>= 9.20151004~), rsync, sbsigntool [amd64 arm64 armhf i386], kernel-wedge (>= 2.93~), linux-kbuild-@version@
+Build-Depends: debhelper (>= 9.20151004~), rsync, @signer_package@ [amd64 arm64 armhf i386], kernel-wedge (>= 2.93~), linux-kbuild-@version@
 Vcs-Git: https://anonscm.debian.org/git/kernel/linux-signed.git
 Vcs-Browser: https://anonscm.debian.org/cgit/kernel/linux-signed.git
 Homepage: https://www.kernel.org/
-- 
2.1.4

[toc] | [prev] | [next] | [standalone]

#56701

[Multipart message — attachments visible in raw view] — view raw

On Mon, 2017-01-23 at 14:12 +0000, Luca Boccassi wrote:
> On Mon, 23 Jan 2017 12:02:04 +0000 Luca Boccassi <luca.boccassi@gmail.com> wrote:
> > On Fri, 02 Sep 2016 16:54:10 +0100 Ben Hutchings <ben@decadent.org.uk> wrote:
> > > Control: severity -1 important
> > > 
> > > On Fri, 10 Jun 2016 16:55:43 +0100 Ben Hutchings <ben@decadent.org.uk>
> > > wrote:
> > > > Package: src:linux-signed
> > > > Version: 1.1
> > > > Severity: serious
> > > > 
> > > > Several changes are needed before it's ready for release:
> > > > 
> > > > 1. Building signed udebs
> > > > 2. Removing the -signed suffix from signed image packages
> > > 
> > > These are now done as of version 2.2.
> > > 
> > > > 3. Signing with an HSM
> > > 
> > > This is not, and it really should be, but I think we can't treat this
> > > as a blocker for testing propagation.
> > > 
> > > Ben.
> > 
> > Hello Ben,
> > 
> > I've done some minor changes to add flags to use pesign which supports
> > hardware tokens via PKCS11. Inline patch for review.
> > 
> > Fortunately kbuild's sign-file already supports just passing a PKCS11
> > URI, which makes it so much simpler. On the other hand as you most
> > likely have found out already pesign needs an NSS DB and cert nicknames
> > and tokens, and all in all it's a really awkward API to use, but that's
> > what we have to work with I suppose.
> > 
> > What do you think?
> > 
> > Thanks!
> > 
> > Kind regards,
> > Luca Boccassi
> 
> And as a followup, the build-time change to attach using pesign. The
> build-dependency is generated based on rules.defs.
[...]

This doesn't make sense to me.  It shouldn't matter which tool was used
to generate the detached signature.  If pesign and sbsigntool use
different file formats for detached signatures (WTF?) then sign.py
should convert to a single format.

Ben.

-- 
Ben Hutchings
Hoare's Law of Large Problems:
        Inside every large problem is a small problem struggling to get
out.

[toc] | [prev] | [next] | [standalone]

#56704

[Multipart message — attachments visible in raw view] — view raw

On Mon, 2017-01-23 at 15:02 +0000, Ben Hutchings wrote:
> On Mon, 2017-01-23 at 14:12 +0000, Luca Boccassi wrote:
> > On Mon, 23 Jan 2017 12:02:04 +0000 Luca Boccassi <luca.boccassi@gmail.com> wrote:
> > > On Fri, 02 Sep 2016 16:54:10 +0100 Ben Hutchings <ben@decadent.org.uk> wrote:
> > > > Control: severity -1 important
> > > > 
> > > > On Fri, 10 Jun 2016 16:55:43 +0100 Ben Hutchings <ben@decadent.org.uk>
> > > > wrote:
> > > > > Package: src:linux-signed
> > > > > Version: 1.1
> > > > > Severity: serious
> > > > > 
> > > > > Several changes are needed before it's ready for release:
> > > > > 
> > > > > 1. Building signed udebs
> > > > > 2. Removing the -signed suffix from signed image packages
> > > > 
> > > > These are now done as of version 2.2.
> > > > 
> > > > > 3. Signing with an HSM
> > > > 
> > > > This is not, and it really should be, but I think we can't treat this
> > > > as a blocker for testing propagation.
> > > > 
> > > > Ben.
> > > 
> > > Hello Ben,
> > > 
> > > I've done some minor changes to add flags to use pesign which supports
> > > hardware tokens via PKCS11. Inline patch for review.
> > > 
> > > Fortunately kbuild's sign-file already supports just passing a PKCS11
> > > URI, which makes it so much simpler. On the other hand as you most
> > > likely have found out already pesign needs an NSS DB and cert nicknames
> > > and tokens, and all in all it's a really awkward API to use, but that's
> > > what we have to work with I suppose.
> > > 
> > > What do you think?
> > > 
> > > Thanks!
> > > 
> > > Kind regards,
> > > Luca Boccassi
> > 
> > And as a followup, the build-time change to attach using pesign. The
> > build-dependency is generated based on rules.defs.
> [...]
> 
> This doesn't make sense to me.  It shouldn't matter which tool was used
> to generate the detached signature.  If pesign and sbsigntool use
> different file formats for detached signatures (WTF?) then sign.py
> should convert to a single format.
> 
> Ben.

I'm using this because I've seen sbattach barf at least once with a
pesign detached .sig (unfortunately in a build worker with ephemeral
chroot so don't have logs/files).
Might have been something as silly as padding, which IIRC sbsigntool
adds by default but pesign doesn't (there's a very helpfully not
documented --padding option). Or it might have been gremlins.

Kind regards,
Luca Boccassi

[toc] | [prev] | [next] | [standalone]

#56700

[Multipart message — attachments visible in raw view] — view raw

On Mon, 2017-01-23 at 12:02 +0000, Luca Boccassi wrote:
> > On Fri, 02 Sep 2016 16:54:10 +0100 Ben Hutchings <ben@decadent.org.uk> wrote:
> > Control: severity -1 important
> > 
> > On Fri, 10 Jun 2016 16:55:43 +0100 Ben Hutchings <ben@decadent.org.uk>
> > wrote:
> > > Package: src:linux-signed
> > > Version: 1.1
> > > Severity: serious
> > > 
> > > Several changes are needed before it's ready for release:
> > > 
> > > 1. Building signed udebs
> > > 2. Removing the -signed suffix from signed image packages
> > 
> > These are now done as of version 2.2.
> > 
> > > 3. Signing with an HSM
> > 
> > This is not, and it really should be, but I think we can't treat this
> > as a blocker for testing propagation.
> > 
> > Ben.
> 
> Hello Ben,
> 
> I've done some minor changes to add flags to use pesign which supports
> hardware tokens via PKCS11. Inline patch for review.
> 
> Fortunately kbuild's sign-file already supports just passing a PKCS11
> URI, which makes it so much simpler. On the other hand as you most
> likely have found out already pesign needs an NSS DB and cert nicknames
> and tokens, and all in all it's a really awkward API to use, but that's
> what we have to work with I suppose.
> 
> What do you think?

What I left implicit in step 3 was '...held by the FTP team'.  I could
use a smartcard for signing but there's never going to be a trust path
from a Microsoft or OEM certificate to my personal key (nor do I want
to be the only uploader of src:linux-signed).  The work towards that is
tracked by #821051.

Ben.

-- 
Ben Hutchings
Hoare's Law of Large Problems:
        Inside every large problem is a small problem struggling to get
out.

[toc] | [prev] | [next] | [standalone]

#56703

[Multipart message — attachments visible in raw view] — view raw

On Mon, 2017-01-23 at 14:52 +0000, Ben Hutchings wrote:
> On Mon, 2017-01-23 at 12:02 +0000, Luca Boccassi wrote:
> > > On Fri, 02 Sep 2016 16:54:10 +0100 Ben Hutchings <ben@decadent.org.uk> wrote:
> > > Control: severity -1 important
> > > 
> > > On Fri, 10 Jun 2016 16:55:43 +0100 Ben Hutchings <ben@decadent.org.uk>
> > > wrote:
> > > > Package: src:linux-signed
> > > > Version: 1.1
> > > > Severity: serious
> > > > 
> > > > Several changes are needed before it's ready for release:
> > > > 
> > > > 1. Building signed udebs
> > > > 2. Removing the -signed suffix from signed image packages
> > > 
> > > These are now done as of version 2.2.
> > > 
> > > > 3. Signing with an HSM
> > > 
> > > This is not, and it really should be, but I think we can't treat this
> > > as a blocker for testing propagation.
> > > 
> > > Ben.
> > 
> > Hello Ben,
> > 
> > I've done some minor changes to add flags to use pesign which supports
> > hardware tokens via PKCS11. Inline patch for review.
> > 
> > Fortunately kbuild's sign-file already supports just passing a PKCS11
> > URI, which makes it so much simpler. On the other hand as you most
> > likely have found out already pesign needs an NSS DB and cert nicknames
> > and tokens, and all in all it's a really awkward API to use, but that's
> > what we have to work with I suppose.
> > 
> > What do you think?
> 
> What I left implicit in step 3 was '...held by the FTP team'.  I could
> use a smartcard for signing but there's never going to be a trust path
> from a Microsoft or OEM certificate to my personal key (nor do I want
> to be the only uploader of src:linux-signed).  The work towards that is
> tracked by #821051.
> 
> Ben.

Hi,

Yep I'm following that bug and others. I just thought having support in
linux-sign itself would be useful for users who want to self-sign and
for downstream distros that rebuild the kernel and don't use dak. The
latter is my case hence these changes, and I thought to share them back
in case they could be useful for others.

Kind regards,
Luca Boccassi

[toc] | [prev] | [next] | [standalone]

#57812 — Bug#826959: marked as done (linux-signed is not yet suitable for testing)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Fri, 19 May 2017 23:18:16 +0000
with message-id <E1dBrA0-0000ia-4f@fasolo.debian.org>
and subject line Bug#862902: Removed package(s) from unstable
has caused the Debian Bug report #826959,
regarding linux-signed is not yet suitable for testing
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
826959: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=826959
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web