Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) client-ip=23.128.96.38;
MIME-Version: 1.0
References: <CAFSh4UwYYAOb0YpC=WAL6SD+8jTLuSkhgrgjh8JmogUb10V=zw@mail.gmail.com>
 <CAK7LNASE6H2GoXzJ1PXWEqsemQ3ny1K34vOxN0uVn1fh7Mmt5A@mail.gmail.com> <CAFSh4UwkXyTnECgJBQA4uBqD0QOFiUBvj=aOy7qzXZqAZKYkcQ@mail.gmail.com>
In-Reply-To: <CAFSh4UwkXyTnECgJBQA4uBqD0QOFiUBvj=aOy7qzXZqAZKYkcQ@mail.gmail.com>
From:   Masahiro Yamada <masahiroy@kernel.org>
Date:   Tue, 12 Dec 2023 03:15:31 +0900
Message-ID: <CAK7LNAQE0vuAEqq+S_9bQ6h12TmyUDut238Q0LmeodfZZxWR+Q@mail.gmail.com>
Subject: Re: Building signed debs
To:     Tom Cook <tom.k.cook@gmail.com>
Cc:     linux-modules <linux-modules@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, Dec 11, 2023 at 7:19=E2=80=AFPM Tom Cook <tom.k.cook@gmail.com> wro=
te:
>
> On Sat, Dec 9, 2023 at 6:18=E2=80=AFPM Masahiro Yamada <masahiroy@kernel.=
org> wrote:
> > On Fri, Dec 8, 2023 at 8:14=E2=80=AFPM Tom Cook <tom.k.cook@gmail.com> =
wrote:
> > >
> > > I'm trying to build a signed .deb kernel package of
> > > https://github.com/torvalds/linux/tree/v6.6.  I've copied
> > > certs/default_x509.genkey to certs/x509.genkey.  The .config is the
> > > one from Ubuntu 23.10's default kernel with all new options accepted
> > > at their default and CONFIG_SYSTEM_TRUSTED_KEYS=3D"" and
> > > CONFIG_SYSTEM_REVOCATION_KEYS=3D"".
> > >
> > > This builds the kernel and modules, signs the modules, compresses the
> > > modules and then attempts to sign the modules again.  That fails,
> > > because the .ko module files are now .ko.zst files and the file it's
> > > trying to sign isn't there.  Full failure is pasted below.
> >
> >
> >
> > Modules are signed before the compression.
>
> Reading back through my earlier email, I wasn't clear that when I said "T=
his
> builds the kernel..." I meant "`make deb-pkg` builds the kernel".  I'm no=
t
> doing anything outlandish here, I think, just expecting the build system =
to
> work.
>
> Regards,
> Tom


OK, I understood.


The error is caused by the following lines
in scripts/package/builddeb:


# re-sign stripped modules
if is_enabled CONFIG_MODULE_SIG_ALL; then
        ${MAKE} -f ${srctree}/Makefile
INSTALL_MOD_PATH=3D"${image_pdir}" modules_sign
fi


The error happens when all of the following three
are enabled.

 - CONFIG_DEBUG_INFO
 - CONFIG_MODULE_SIG_ALL
 - CONFIG_MODULE_COMPRESS_*


If you disable one of them, you can do deb-pkg.


--=20
Best Regards
Masahiro Yamada