Skip to content

Update kernel-64k to have kexec signature verification #11569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rlmenge merged 2 commits into from
Dec 20, 2024
Merged

Update kernel-64k to have kexec signature verification #11569

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ff61fca
Enable kexec sig
rlmenge Dec 19, 2024
429891b
Bump entangled specs
rlmenge Dec 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion SPECS-SIGNED/kernel-64k-signed/kernel-64k-signed.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
Summary: Signed Linux Kernel for %{buildarch} systems
Name: kernel-64k-signed-%{buildarch}
Version: 6.6.57.1
Release: 5%{?dist}
Release: 6%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -105,6 +105,9 @@ echo "initrd of kernel %{uname_r} removed" >&2
%exclude /module_info.ld

%changelog
* Wed Dec 18 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.57.1-6
- Bump release to match kernel-64k

* Thu Nov 07 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.57.1-5
- Original version for Azure Linux
- Starting with release 5 to align with kernel release.
Expand Down
5 changes: 4 additions & 1 deletion SPECS-SIGNED/kernel-signed/kernel-signed.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
Summary: Signed Linux Kernel for %{buildarch} systems
Name: kernel-signed-%{buildarch}
Version: 6.6.57.1
Release: 5%{?dist}
Release: 6%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -145,6 +145,9 @@ echo "initrd of kernel %{uname_r} removed" >&2
%exclude /module_info.ld

%changelog
* Wed Dec 18 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.57.1-6
- Bump release to match kernel-64k

* Mon Nov 25 2024 Chris Co <chrco@microsoft.com> - 6.6.57.1-5
- Bump release to match kernel

Expand Down
5 changes: 4 additions & 1 deletion SPECS-SIGNED/kernel-uki-signed/kernel-uki-signed.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
Summary: Signed Unified Kernel Image for %{buildarch} systems
Name: kernel-uki-signed-%{buildarch}
Version: 6.6.57.1
Release: 5%{?dist}
Release: 6%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -68,6 +68,9 @@ popd
/boot/efi/EFI/Linux/vmlinuz-uki-%{kernelver}.efi

%changelog
* Wed Dec 18 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.57.1-6
- Bump release to match kernel-64k

* Mon Nov 25 2024 Chris Co <chrco@microsoft.com> - 6.6.57.1-5
- Bump release to match kernel

Expand Down
5 changes: 3 additions & 2 deletions SPECS/kernel-64k/config_aarch64
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,7 +275,8 @@ CONFIG_KEXEC_CORE=y
CONFIG_HAVE_IMA_KEXEC=y
# CONFIG_KEXEC is not set
CONFIG_KEXEC_FILE=y
# CONFIG_KEXEC_SIG is not set
CONFIG_KEXEC_SIG=y
CONFIG_KEXEC_IMAGE_VERIFY_SIG=y
CONFIG_CRASH_DUMP=y
# end of Kexec and crash features
# end of General setup
Expand Down Expand Up @@ -10782,7 +10783,7 @@ CONFIG_X509_CERTIFICATE_PARSER=y
# CONFIG_PKCS8_PRIVATE_KEY_PARSER is not set
CONFIG_PKCS7_MESSAGE_PARSER=y
# CONFIG_PKCS7_TEST_KEY is not set
# CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
CONFIG_SIGNED_PE_FILE_VERIFICATION=y
# CONFIG_FIPS_SIGNATURE_SELFTEST is not set

#
Expand Down
2 changes: 1 addition & 1 deletion SPECS/kernel-64k/kernel-64k.signatures.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"Signatures": {
"azurelinux-ca-20230216.pem": "d545401163c75878319f01470455e6bc18a5968e39dd964323225e3fe308849b",
"config_aarch64": "81527e718a88af9535ed5184f8c4d70eeece5374b197c9bade7cb6c818759cf8",
"config_aarch64": "2e511edb6a5a6236c6f7307f070df422bd6032b1e572f8f44ef4134ecea7d5b7",
"cpupower": "d7518767bf2b1110d146a49c7d42e76b803f45eb8bd14d931aa6d0d346fae985",
"cpupower.service": "b057fe9e5d0e8c36f485818286b80e3eba8ff66ff44797940e99b1fd5361bb98",
"sha512hmac-openssl.sh": "02ab91329c4be09ee66d759e4d23ac875037c3b56e5a598e32fd1206da06a27f",
Expand Down
5 changes: 4 additions & 1 deletion SPECS/kernel-64k/kernel-64k.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
Summary: Linux Kernel
Name: kernel-64k
Version: 6.6.57.1
Release: 5%{?dist}
Release: 6%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -370,6 +370,9 @@ echo "initrd of kernel %{uname_r} removed" >&2
%{_sysconfdir}/bash_completion.d/bpftool

%changelog
* Wed Dec 18 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.57.1-6
- Enable kexec signature verification

* Thu Nov 07 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.57.1-5
- Initial CBL-Mariner import from Photon (license: Apache2).
- Starting with release 5 to align with kernel release.
Expand Down
5 changes: 4 additions & 1 deletion SPECS/kernel-headers/kernel-headers.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
Summary: Linux API header files
Name: kernel-headers
Version: 6.6.57.1
Release: 5%{?dist}
Release: 6%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -75,6 +75,9 @@ done
%endif

%changelog
* Wed Dec 18 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.57.1-6
- Bump release to match kernel-64k

* Mon Nov 25 2024 Chris Co <chrco@microsoft.com> - 6.6.57.1-5
- Bump release to match kernel

Expand Down
5 changes: 4 additions & 1 deletion SPECS/kernel/kernel-uki.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
Summary: Unified Kernel Image
Name: kernel-uki
Version: 6.6.57.1
Release: 5%{?dist}
Release: 6%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -70,6 +70,9 @@ cp %{buildroot}/boot/vmlinuz-uki-%{kernelver}.efi %{buildroot}/boot/efi/EFI/Linu
/boot/efi/EFI/Linux/vmlinuz-uki-%{kernelver}.efi

%changelog
* Wed Dec 18 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.57.1-6
- Bump release to match kernel-64k

* Mon Nov 25 2024 Chris Co <chrco@microsoft.com> - 6.6.57.1-5
- Bump release to match kernel

Expand Down
5 changes: 4 additions & 1 deletion SPECS/kernel/kernel.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
Summary: Linux Kernel
Name: kernel
Version: 6.6.57.1
Release: 5%{?dist}
Release: 6%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -424,6 +424,9 @@ echo "initrd of kernel %{uname_r} removed" >&2
%{_sysconfdir}/bash_completion.d/bpftool

%changelog
* Wed Dec 18 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.57.1-6
- Bump release to match kernel-64k

* Mon Nov 25 2024 Chris Co <chrco@microsoft.com> - 6.6.57.1-5
- Enable ICE ethernet driver

Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/pkggen_core_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
filesystem-1.1-21.azl3.aarch64.rpm
kernel-headers-6.6.57.1-5.azl3.noarch.rpm
kernel-headers-6.6.57.1-6.azl3.noarch.rpm
glibc-2.38-8.azl3.aarch64.rpm
glibc-devel-2.38-8.azl3.aarch64.rpm
glibc-i18n-2.38-8.azl3.aarch64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/pkggen_core_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
filesystem-1.1-21.azl3.x86_64.rpm
kernel-headers-6.6.57.1-5.azl3.noarch.rpm
kernel-headers-6.6.57.1-6.azl3.noarch.rpm
glibc-2.38-8.azl3.x86_64.rpm
glibc-devel-2.38-8.azl3.x86_64.rpm
glibc-i18n-2.38-8.azl3.x86_64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,7 +156,7 @@ intltool-0.51.0-7.azl3.noarch.rpm
itstool-2.0.7-1.azl3.noarch.rpm
kbd-2.2.0-2.azl3.aarch64.rpm
kbd-debuginfo-2.2.0-2.azl3.aarch64.rpm
kernel-headers-6.6.57.1-5.azl3.noarch.rpm
kernel-headers-6.6.57.1-6.azl3.noarch.rpm
kmod-30-1.azl3.aarch64.rpm
kmod-debuginfo-30-1.azl3.aarch64.rpm
kmod-devel-30-1.azl3.aarch64.rpm
Expand Down
4 changes: 2 additions & 2 deletions toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,8 +161,8 @@ intltool-0.51.0-7.azl3.noarch.rpm
itstool-2.0.7-1.azl3.noarch.rpm
kbd-2.2.0-2.azl3.x86_64.rpm
kbd-debuginfo-2.2.0-2.azl3.x86_64.rpm
kernel-cross-headers-6.6.57.1-5.azl3.noarch.rpm
kernel-headers-6.6.57.1-5.azl3.noarch.rpm
kernel-cross-headers-6.6.57.1-6.azl3.noarch.rpm
kernel-headers-6.6.57.1-6.azl3.noarch.rpm
kmod-30-1.azl3.x86_64.rpm
kmod-debuginfo-30-1.azl3.x86_64.rpm
kmod-devel-30-1.azl3.x86_64.rpm
Expand Down