Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:4 as permitted sender) client-ip=2620:137:e000::3:4;
MIME-Version: 1.0
References: <CAFSh4UwYYAOb0YpC=WAL6SD+8jTLuSkhgrgjh8JmogUb10V=zw@mail.gmail.com>
 <CAK7LNASE6H2GoXzJ1PXWEqsemQ3ny1K34vOxN0uVn1fh7Mmt5A@mail.gmail.com>
In-Reply-To: <CAK7LNASE6H2GoXzJ1PXWEqsemQ3ny1K34vOxN0uVn1fh7Mmt5A@mail.gmail.com>
From:   Tom Cook <tom.k.cook@gmail.com>
Date:   Mon, 11 Dec 2023 10:19:06 +0000
Message-ID: <CAFSh4UwkXyTnECgJBQA4uBqD0QOFiUBvj=aOy7qzXZqAZKYkcQ@mail.gmail.com>
Subject: Re: Building signed debs
To:     Masahiro Yamada <masahiroy@kernel.org>
Cc:     linux-modules <linux-modules@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Sat, Dec 9, 2023 at 6:18=E2=80=AFPM Masahiro Yamada <masahiroy@kernel.or=
g> wrote:
> On Fri, Dec 8, 2023 at 8:14=E2=80=AFPM Tom Cook <tom.k.cook@gmail.com> wr=
ote:
> >
> > I'm trying to build a signed .deb kernel package of
> > https://github.com/torvalds/linux/tree/v6.6.  I've copied
> > certs/default_x509.genkey to certs/x509.genkey.  The .config is the
> > one from Ubuntu 23.10's default kernel with all new options accepted
> > at their default and CONFIG_SYSTEM_TRUSTED_KEYS=3D"" and
> > CONFIG_SYSTEM_REVOCATION_KEYS=3D"".
> >
> > This builds the kernel and modules, signs the modules, compresses the
> > modules and then attempts to sign the modules again.  That fails,
> > because the .ko module files are now .ko.zst files and the file it's
> > trying to sign isn't there.  Full failure is pasted below.
>
>
>
> Modules are signed before the compression.

Reading back through my earlier email, I wasn't clear that when I said "Thi=
s
builds the kernel..." I meant "`make deb-pkg` builds the kernel".  I'm not
doing anything outlandish here, I think, just expecting the build system to
work.

Regards,
Tom