[Unstable][PATCH v2 0/3] linux: Staging modules should be unsigned (LP: #1642368)

[Juerg Haefliger]

On Tue, 31 May 2022 16:49:51 +0100
Dimitri John Ledkov <dimitri.ledkov at canonical.com> wrote:

> with these patches applied, the ddebs (debug package) staging modules
> are still signed

Rats.
 
> From linux-image-unsigned-5.18.0-6-generic-dbgsym_5.18.0-6.6_amd64.ddeb
> 
> I don't think there is currently a tool that has ability to find &
> strip digital signature only, whilst keeping the rest of the module
> intact. I wonder if we need to extend sign-file or kmodsign to support
> stripping the signature alone. Or do some hackish script in awk to
> achieve that.

Probably best to go back to the original approach of modifying the upstream
Makefile snippet and only sign explicitly listed modules. But I don't like the
inclusion file in the source tree. How about keeping that in the debian/
directory?

...Juerg

 
> $ modinfo ./pi433/pi433.ko
> filename:
> /home/xnox/canonical/kernel/ubuntu/kinetic/linux/debug/usr/lib/debug/lib/modules/5.18.0-6-generic/kernel/drivers/staging/./pi433/pi433.ko
> alias:          spi:pi433
> license:        GPL
> description:    Driver for Pi433
> author:         Marcus Wolf, <linux at wolf-entwicklungen.de>
> srcversion:     E6314D95D9F61FF16D934B4
> alias:          of:N*T*CSmarthome-Wolf,pi433C*
> alias:          of:N*T*CSmarthome-Wolf,pi433
> depends:
> staging:        Y
> retpoline:      Y
> intree:         Y
> name:           pi433
> vermagic:       5.18.0-6-generic SMP preempt mod_unload modversions
> sig_id:         PKCS#7
> signer:         Build time autogenerated kernel key
> sig_key:        66:F4:E2:73:8C:11:CC:12:55:18:45:E1:94:92:BC:C0:DF:37:E5:40
> sig_hashalgo:   sha512
> signature:      30:C0:65:A9:FE:45:5C:B1:5A:A0:18:DF:A2:C5:A5:89:29:B2:C4:A2:
> 96:43:4B:F0:4D:1E:36:83:1D:C4:65:14:C1:14:A6:11:15:10:A5:9C:
> A1:6B:D3:AC:49:93:BD:65:81:E9:98:12:DF:AE:EC:76:97:32:26:58:
> F6:0C:3A:5C:39:C9:01:58:0F:57:E3:05:D4:FC:35:BB:64:B1:1F:E4:
> AF:66:8D:29:7A:85:48:AF:15:A4:C4:E4:B5:3D:FE:83:2A:C5:31:B3:
> 71:50:C4:37:FF:52:F1:4A:59:B8:F5:6B:80:DA:48:4C:42:25:A2:3F:
> 31:F1:BC:E0:99:E2:7A:86:03:2A:55:0F:49:04:D6:52:BC:2A:8F:48:
> 41:CB:55:07:DC:F4:93:B6:26:47:3E:10:25:50:8C:7A:85:C5:5B:BC:
> F8:D1:8D:73:A3:A3:B4:12:90:36:2F:02:48:0D:FA:E7:6E:88:57:37:
> 8E:6E:E0:45:CA:73:C0:EA:27:59:11:D2:AE:A8:EC:38:FF:65:2D:42:
> 54:3E:0B:BE:00:06:DA:77:D0:E9:B1:B0:BD:01:BA:1B:49:95:E0:85:
> 9F:F5:53:4E:D9:54:7C:9C:C0:A5:A1:E2:B5:EA:29:11:7D:7B:37:1C:
> 92:F6:7D:4B:81:CA:83:FA:B4:8C:F9:CC:68:8B:B7:B7:D0:A2:5B:8D:
> 3A:D5:88:66:B6:DB:D9:FE:16:4E:E7:B9:00:7D:8F:72:61:8B:E7:1F:
> 00:D3:1C:25:D8:F7:E0:0A:C8:A2:F5:18:03:2B:8E:76:33:3E:7E:4B:
> 28:A0:4C:36:2B:E2:8F:66:48:FE:3D:0F:59:46:21:AC:DA:EF:7A:FD:
> C7:C6:4C:89:EC:28:F2:BB:4B:8A:96:CA:FF:73:C7:48:8A:3E:20:D4:
> C8:A2:5D:94:A1:14:D7:93:02:3A:6F:45:88:9B:DF:FD:33:1A:AB:CF:
> DB:9D:3A:B7:08:89:A5:29:5A:BC:63:1A:5B:1D:1D:7A:0E:C0:38:78:
> 02:F1:D0:0B:8D:21:19:31:6F:72:E2:71:49:D3:41:5B:8A:10:C1:90:
> 09:48:41:3B:3F:F5:08:DB:87:CD:5C:48:80:DE:39:B6:FB:26:17:AE:
> 57:6F:22:EE:3F:27:28:AE:BB:9B:7B:CC:C7:B5:EB:68:13:3B:51:DD:
> 3A:9F:7F:A0:8D:4E:DF:A4:5F:AE:B6:84:B9:E6:D1:DF:D8:75:94:01:
> EA:AE:37:20:6B:F6:C6:51:AD:C4:32:68:2E:D1:99:F8:6C:0D:FB:7D:
> A8:A0:06:5C:84:F9:DA:91:DF:2F:AF:88:CA:5A:C1:32:D7:A3:20:6B:
> 72:D7:CC:E5:17:F9:52:EF:42:50:38:F7
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20220602/bce73bcc/attachment.sig>