[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#823107: marked as done (local{mod,yes}config should fix references to unavailable certificates)

Your message dated Sun, 9 May 2021 21:15:24 +0200
with message-id <YJg0zHWNX+pGN1Zc@eldamar.lan>
and subject line Re: Bug#823107: linux: make deb-pkg fails: No rule to make target 'debian/certs/benh@debian.org.cert.pem')
has caused the Debian Bug report #823107,
regarding local{mod,yes}config should fix references to unavailable certificates
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
823107: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823107
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: src:linux
Version: 4.5.2-1

Dear maintainer:

I merged the output of "lsmod" in two different virtual machines
running stretch/sid to create a minimal kernel which works on both.

The combined file is attached as "lsmod.txt".

Then I created a .config file by executing this script:


#!/bin/sh
cd linux-source-4.5
rm -f .config
make LSMOD=../lsmod.txt localyesconfig
cp -p .config ../dot.config

The resulting file, dot.config, is also attached.


Then I tried to use upstream target, as recommended, to create a .deb
package for the kernel, using this script:


#!/bin/sh
cd linux-source-4.5
time -p make -j4 EXTRAVERSION="-qemu-amd64" KDEB_PKGVERSION=$(make kernelversion)-$(date +%Y%m%d).0 bindeb-pkg


I already did this in jessie so I expected this to work on stretch as
well, but this is what heppened:


make[3]: *** No rule to make target 'debian/certs/benh@debian.org.cert.pem', needed by 'certs/x509_certificate_list'.  Stop.
Makefile:954: recipe for target 'certs' failed
make[2]: *** [certs] Error 2
make[2]: *** Waiting for unfinished jobs....
  CHK     include/generated/compile.h
  CHK     kernel/config_data.h
scripts/package/Makefile:97: recipe for target 'bindeb-pkg' failed
make[1]: *** [bindeb-pkg] Error 2
Makefile:1255: recipe for target 'bindeb-pkg' failed
make: *** [bindeb-pkg] Error 2
Command exited with non-zero status 2


Does this mean I need your key to build a custom kernel? I hope not.

Should I remove CONFIG_SYSTEM_TRUSTED_KEYS from .config before building
the kernel? I hope not.

Maybe "make localyesconfig" should not take CONFIG_SYSTEM_TRUSTED_KEYS
from the running kernel or the linux-source package? I don't know.

To summarize: I think this should work without having to do anything
special, but currently, it does not.

Thanks.
8250_fintek
ablk_helper
acpi_cpufreq
aesni_intel
aes_x86_64
ansi_cprng
ata_generic
ata_piix
autofs4
button
cirrus
crc16
crc32c_generic
crc32c_intel
crc32_pclmul
crct10dif_pclmul
cryptd
dm_mod
drbg
drm
drm_kms_helper
ehci_hcd
ehci_pci
evdev
ext4
floppy
gf128mul
ghash_clmulni_intel
glue_helper
hmac
i2c_piix4
irqbypass
jbd2
jitterentropy_rng
joydev
kvm
kvm_intel
libata
lrw
mbcache
Module
parport
parport_pc
pcspkr
ppdev
processor
psmouse
pvpanic
qxl
scsi_mod
serio_raw
tpm
tpm_tis
ttm
uhci_hcd
usb_common
usbcore
virtio
virtio_balloon
virtio_blk
virtio_console
virtio_net
virtio_pci
virtio_ring
virtio_scsi

Attachment: dot.config.gz
Description: application/gzip


--- End Message ---
--- Begin Message --- 
Source: linux
Source-Version: 4.7~rc3-1~exp1

Hi,

On Sat, Apr 30, 2016 at 11:41:09PM +0200, Ben Hutchings wrote:
> Control: reopen -1
> Control: retitle -1 local{mod,yes}config should fix references to unavailable certificates
> Control: tag -1 upstream
> 
> On Sat, 2016-04-30 at 23:24 +0200, Santiago Vila wrote:
> > On Sat, Apr 30, 2016 at 08:51:25PM +0000, Debian Bug Tracking System wrote:
> > 
> > > 
> > > You wrote:
> > > [...]
> > > > 
> > > > Should I remove CONFIG_SYSTEM_TRUSTED_KEYS from .config before building
> > > > the kernel? I hope not.
> > > [...]
> > > 
> > > Yes, you must do that.  Your custom kernel configuration should be
> > > based on the appropriate file provided in linux-source-4.5.  These have
> > > the CONFIG_MODULE_SIG_ALL, CONFIG_MODULE_SIG_KEY and
> > > CONFIG_SYSTEM_TRUSTED_KEYS settings removed so that custom kernels will
> > > get modules signed by a one-time key.
> > If I have to remove CONFIG_SYSTEM_TRUSTED_KEYS by hand, then
> > documentation is wrong.
> [...]
> 
> Oh, I see the problem.  I didn't realise that the local{mod,yes}config
> rules would (a) copy the config file from /boot or (b) keep the keyring
> config symbols unchanged.

This seems to be fixed since 4.7-rc1 with upstream commit 96bab35d1c4a
("localmodconfig: Reset certificate paths").

Regards,
Salvatore

--- End Message ---
Reply to: