From 20fce9fe76de494ff901f017a50d6f4dfc1661e0 Mon Sep 17 00:00:00 2001 From: m2 <69128853+m2Giles@users.noreply.github.com> Date: Thu, 18 Jul 2024 21:43:15 -0400 Subject: [PATCH] feat: Enable Dual Signing for akmods (#215) --- .github/workflows/reusable-build.yml | 24 +++++++++----- Containerfile.common | 31 +++++++++--------- Containerfile.extra | 24 +++++++------- Containerfile.nvidia | 31 +++++++++--------- Containerfile.zfs | 20 +++++++----- build-prep.sh | 26 +++++++++++---- certs/private_key_2.priv | 0 certs/private_key_2.priv.test | 28 ++++++++++++++++ certs/public_key.der | Bin 1528 -> 1466 bytes certs/public_key_2.der | Bin 0 -> 1528 bytes certs/public_key_2.der.test | Bin 0 -> 819 bytes dual-sign-zfs.sh | 47 +++++++++++++++++++++++++++ dual-sign.sh | 41 +++++++++++++++++++++++ 13 files changed, 207 insertions(+), 65 deletions(-) create mode 100644 certs/private_key_2.priv create mode 100644 certs/private_key_2.priv.test create mode 100644 certs/public_key_2.der create mode 100644 certs/public_key_2.der.test create mode 100755 dual-sign-zfs.sh create mode 100755 dual-sign.sh diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 3119af6..1cfe8b1 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -3,12 +3,12 @@ on: workflow_call: inputs: fedora_version: - description: 'The Fedora release version: 39, 40, etc' + description: "The Fedora release version: 39, 40, etc" required: true type: string env: - IMAGE_BASE_NAME: akmods - IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} + IMAGE_BASE_NAME: akmods + IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.fedora_version }} @@ -170,16 +170,21 @@ jobs: io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/1728152?s=200&v=4 - - name: Retrieve akmods signing key + - name: Retrieve Signing Key + if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group' + shell: bash run: | mkdir -p certs - if [[ "${{ github.event_name }}" == "pull_request" ]]; then - echo "Using test signing key" + if [[ "${{ github.event_name }}" == 'pull_request' ]]; then + echo "This should not have run... exiting..." + exit 1 else - echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key.priv + echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv + echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv + # DEBUG: get character count of key + wc -c certs/private_key.priv + wc -c certs/private_key_2.priv fi - # DEBUG: get character count of key - wc -c certs/private_key.priv # Build image using Buildah action - name: Build Image @@ -197,6 +202,7 @@ jobs: KERNEL_FLAVOR=${{ matrix.kernel_flavor }} FEDORA_MAJOR_VERSION=${{ matrix.fedora_version }} RPMFUSION_MIRROR=${{ vars.RPMFUSION_MIRROR }} + DUAL_SIGN=true labels: ${{ steps.meta.outputs.labels }} oci: false diff --git a/Containerfile.common b/Containerfile.common index 2a27213..a5d7d6b 100644 --- a/Containerfile.common +++ b/Containerfile.common @@ -15,8 +15,9 @@ FROM ${BUILDER_BASE} AS builder ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}" ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}" ARG RPMFUSION_MIRROR="" +ARG DUAL_SIGN="true" -COPY build*.sh /tmp +COPY build*.sh dual-sign.sh /tmp/ COPY certs /tmp/certs # cached kernel rpms @@ -29,12 +30,10 @@ ADD https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/repo/fedora-${FEDORA ADD https://negativo17.org/repos/fedora-multimedia.repo \ /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/negativo17-fedora-multimedia.repo -RUN /tmp/build-prep.sh - -RUN /tmp/build-ublue-os-akmods-addons.sh - -# Set kernel name -RUN if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \ +RUN --mount=type=cache,dst=/var/cache/dnf \ + /tmp/build-prep.sh && \ + /tmp/build-ublue-os-akmods-addons.sh && \ + if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \ export KERNEL_NAME="kernel" \ ; else \ export KERNEL_NAME="kernel-surface" \ @@ -48,15 +47,17 @@ RUN if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \ /tmp/build-kmod-v4l2loopback.sh && \ /tmp/build-kmod-wl.sh && \ /tmp/build-kmod-xpadneo.sh && \ - /tmp/build-kmod-xone.sh - -RUN cp /tmp/ublue-os-akmods-addons/rpmbuild/RPMS/noarch/ublue-os-akmods-addons*.rpm \ - /var/cache/rpms/ublue-os/ -RUN for RPM in $(find /var/cache/akmods/ -type f -name \*.rpm); do \ + /tmp/build-kmod-xone.sh && \ + /tmp/dual-sign.sh && \ + cp /tmp/ublue-os-akmods-addons/rpmbuild/RPMS/noarch/ublue-os-akmods-addons*.rpm \ + /var/cache/rpms/ublue-os/ && \ + for RPM in $(find /var/cache/akmods/ -type f -name \*.rpm); do \ cp "${RPM}" /var/cache/rpms/kmods/; \ - done - -RUN find /var/cache/rpms + done && \ + for RPM in $(find /root/rpmbuild/RPMS/"$(uname -m)"/ -type f -name \*.rpm); do \ + cp "${RPM}" /var/cache/rpms/kmods/; \ + done && \ + find /var/cache/rpms FROM scratch diff --git a/Containerfile.extra b/Containerfile.extra index fcd5450..0d31788 100644 --- a/Containerfile.extra +++ b/Containerfile.extra @@ -15,8 +15,9 @@ FROM ${BUILDER_BASE} AS builder ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}" ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}" ARG RPMFUSION_MIRROR="" +ARG DUAL_SIGN="true" -COPY build*.sh /tmp +COPY build*.sh dual-sign.sh /tmp/ COPY certs /tmp/certs # cached kernel rpms @@ -29,10 +30,9 @@ ADD https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/repo/fedora-${FEDORA ADD https://negativo17.org/repos/fedora-multimedia.repo \ /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/negativo17-fedora-multimedia.repo -RUN /tmp/build-prep.sh - -# Set kernel name -RUN if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \ +RUN --mount=type=cache,dst=/var/cache/dnf \ + /tmp/build-prep.sh && \ + if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \ export KERNEL_NAME="kernel" \ ; else \ export KERNEL_NAME="kernel-surface" \ @@ -53,13 +53,15 @@ RUN if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \ /tmp/build-kmod-rtl88xxau.sh && \ /tmp/build-kmod-ryzen-smu.sh && \ /tmp/build-kmod-vhba.sh && \ - /tmp/build-kmod-VirtualBox.sh - -RUN for RPM in $(find /var/cache/akmods/ -type f -name \*.rpm); do \ + /tmp/build-kmod-VirtualBox.sh && \ + /tmp/dual-sign.sh && \ + for RPM in $(find /var/cache/akmods/ -type f -name \*.rpm); do \ cp "${RPM}" /var/cache/rpms/kmods/; \ - done - -RUN find /var/cache/rpms + done && \ + for RPM in $(find /root/rpmbuild/RPMS/"$(uname -m)"/ -type f -name \*.rpm); do \ + cp "${RPM}" /var/cache/rpms/kmods/; \ + done && \ + find /var/cache/rpms FROM scratch diff --git a/Containerfile.nvidia b/Containerfile.nvidia index 0a5f4d8..42b9203 100644 --- a/Containerfile.nvidia +++ b/Containerfile.nvidia @@ -15,8 +15,9 @@ FROM ${BUILDER_BASE} AS builder ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}" ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}" ARG RPMFUSION_MIRROR="" +ARG DUAL_SIGN="true" -COPY build*.sh /tmp +COPY build*.sh dual-sign.sh /tmp/ COPY certs /tmp/certs # cached kernel rpms @@ -29,25 +30,25 @@ COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-nvidia-a COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset -RUN /tmp/build-prep.sh - -RUN /tmp/build-ublue-os-nvidia-addons.sh - -RUN if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \ +RUN --mount=type=cache,dst=/var/cache/dnf \ + /tmp/build-prep.sh && \ + /tmp/build-ublue-os-nvidia-addons.sh && \ + if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \ export KERNEL_NAME="kernel" \ ; else \ export KERNEL_NAME="kernel-surface" \ ; fi && \ - /tmp/build-kmod-nvidia.sh 550 - -RUN cp /tmp/ublue-os-nvidia-addons/rpmbuild/RPMS/noarch/ublue-os-nvidia-addons*.rpm \ - /var/cache/rpms/ublue-os/ - -RUN for RPM in $(find /var/cache/akmods/ -type f -name \*.rpm); do \ + /tmp/build-kmod-nvidia.sh 550 && \ + /tmp/dual-sign.sh && \ + cp /tmp/ublue-os-nvidia-addons/rpmbuild/RPMS/noarch/ublue-os-nvidia-addons*.rpm \ + /var/cache/rpms/ublue-os/ && \ + for RPM in $(find /var/cache/akmods/ -type f -name \*.rpm); do \ cp "${RPM}" /var/cache/rpms/kmods/; \ - done - -RUN find /var/cache/rpms + done && \ + for RPM in $(find /root/rpmbuild/RPMS/"$(uname -m)"/ -type f -name \*.rpm); do \ + cp "${RPM}" /var/cache/rpms/kmods/; \ + done && \ + find /var/cache/rpms FROM scratch diff --git a/Containerfile.zfs b/Containerfile.zfs index 087905b..1784462 100644 --- a/Containerfile.zfs +++ b/Containerfile.zfs @@ -14,24 +14,26 @@ FROM ${BUILDER_BASE} AS builder ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-40}" ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-coreos-stable}" +ARG DUAL_SIGN="true" ARG RPMFUSION_MIRROR="" ARG ZFS_MINOR_VERSION="${ZFS_MINOR_VERSION:-2.2}" -COPY build*.sh /tmp +COPY build*.sh dual-sign-zfs.sh /tmp/ COPY certs /tmp/certs # cached kernel rpms COPY --from=kernel_cache /tmp/rpms /tmp/kernel_cache # Set kernel name -RUN /tmp/build-prep.sh && \ - /tmp/build-kmod-zfs.sh - -RUN for RPM in $(find /var/cache/akmods/ -type f -name \*.rpm); do \ - cp "${RPM}" /var/cache/rpms/kmods/; \ - done - -RUN find /var/cache/rpms +RUN --mount=type=cache,dst=/var/cache/dnf \ + /tmp/build-prep.sh && \ + if grep -qv "surface" <<< "${KERNEL_FLAVOR}"; then \ + export KERNEL_NAME="kernel" \ + ; else \ + export KERNEL_NAME="kernel-surface" \ + ; fi && \ + /tmp/build-kmod-zfs.sh && \ + /tmp/dual-sign-zfs.sh FROM scratch diff --git a/build-prep.sh b/build-prep.sh index 0a34882..4dc86f7 100755 --- a/build-prep.sh +++ b/build-prep.sh @@ -1,10 +1,10 @@ -#!/bin/sh +#!/usr/bin/bash set -oeux pipefail ### PREPARE REPOS -ARCH="$(rpm -E '%_arch')" +# ARCH="$(rpm -E '%_arch')" RELEASE="$(rpm -E '%fedora')" sed -i 's@enabled=1@enabled=0@g' /etc/yum.repos.d/fedora-cisco-openh264.repo @@ -28,8 +28,8 @@ if [ -n "${RPMFUSION_MIRROR}" ]; then RPMFUSION_MIRROR_RPMS=${RPMFUSION_MIRROR} fi dnf install -y \ - ${RPMFUSION_MIRROR_RPMS}/free/fedora/rpmfusion-free-release-${RELEASE}.noarch.rpm \ - ${RPMFUSION_MIRROR_RPMS}/nonfree/fedora/rpmfusion-nonfree-release-${RELEASE}.noarch.rpm \ + "${RPMFUSION_MIRROR_RPMS}"/free/fedora/rpmfusion-free-release-"${RELEASE}".noarch.rpm \ + "${RPMFUSION_MIRROR_RPMS}"/nonfree/fedora/rpmfusion-nonfree-release-"${RELEASE}".noarch.rpm \ fedora-repos-archive # after F41 launches, bump to 42 @@ -61,10 +61,24 @@ fi install -Dm644 /tmp/certs/public_key.der /etc/pki/akmods/certs/public_key.der install -Dm644 /tmp/certs/private_key.priv /etc/pki/akmods/private/private_key.priv +if [[ "${DUAL_SIGN}" == "true" ]]; then + dnf install -y rpmrebuild + if [[ ! -s "/tmp/certs/private_key_2.priv" ]]; then + echo "WARNING: Using test signing key. Run './generate-akmods-key' for production builds." + cp /tmp/certs/private_key_2.priv{.test,} + cp /tmp/certs/public_key_2.der{.test,} + fi + openssl x509 -in /tmp/certs/public_key_2.der -out /tmp/certs/public_key_2.crt + openssl x509 -in /tmp/certs/public_key.der -out /tmp/certs/public_key.crt + cat /tmp/certs/private_key.priv <(echo) /tmp/certs/public_key.crt >> /tmp/certs/signing_key_1.pem + cat /tmp/certs/private_key_2.priv <(echo) /tmp/certs/public_key_2.crt >> /tmp/certs/signing_key_2.pem + cat /tmp/certs/public_key.crt <(echo) /tmp/certs/public_key_2.crt >> /tmp/certs/public_key_chain.pem +fi + # This is for ZFS more than CoreOS if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then - install -Dm644 /tmp/certs/public_key.der /lib/modules/${KERNEL_VERSION}/build/certs/signing_key.x509 - install -Dm644 /tmp/certs/private_key.priv /lib/modules/${KERNEL_VERSION}/build/certs/signing_key.pem + install -Dm644 /tmp/certs/public_key.der /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.x509 + install -Dm644 /tmp/certs/private_key.priv /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.pem dnf install -y \ autoconf \ automake \ diff --git a/certs/private_key_2.priv b/certs/private_key_2.priv new file mode 100644 index 0000000..e69de29 diff --git a/certs/private_key_2.priv.test b/certs/private_key_2.priv.test new file mode 100644 index 0000000..31f9196 --- /dev/null +++ b/certs/private_key_2.priv.test @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCnVfa8014cwVhH +8SKJFg94/krdWYAAbEG+BVMWfJf84v19bqEUWO9GKYUHTXIOYTzOcdyyYkBDm8hL +DpUGHWtgAut4l4cDpDCkL9sJzAhKS6lOW0pCqaZzqJoq8AUyK84j/l3vEBwuucZo +HypEyK+GeaWFc5fo3P/UQmYML78YgS2Lbb/MDwH+Zfrmt9IoKv75oIdmOVC/dpzS +MiJZB1trjKyS+31o6gXCI43kpMsRGSHHqW6k5zhNNEAN/0uiGI28C2WDrB4v2igg +bpF6QOMyrCqKs+oHUWndadUzG6Dwz+f4oZ1F7M/J5Xn8N2F1VEDqvvMBU2ZquRyX +NLzbJvcnAgMBAAECggEAQ9LI7iHxvE/1eztWVx/054KST4NOKV23i9BWq/+WDu7l +9agYa8ncOaDshVgziXaKEdb+r+K4z25d0WY4qsDT25dzX25zT9uFx5aJ/j+PgKWI +GvVPdROUHr7QteSRBpPQurAH3LS354xuyZcQJ877rdKybxO6F60zmBHNkNTtbH2P +M5eN88lF398v8Pu3fDce6CWSP9SGqLp43FJMbFMYrWkppzX28Ru0JqDOT3LSWeQy +JAmrC/Oh5S2mLu6AhlqrMJEJ5ErIVpk9n3QZsa5knXsB56dP/kzWyQgirMWotF+O +K4jGo6iHSfFGmYJhopJjVYsuMrJtgpZN8u1VRbMIEQKBgQDakV86A7k7s5ORfI22 +lwB5QukkiA/XT7lP/kcGEem12hW/Gi7vfuwJLMA1i2JP0pmKANMxQG5YweaHSUhX +/09H7BGlqPvwpWBJ5qqW7hkSh0N6VMwEmnYvHfNZh9PiQx2q9zL8+SOoUXCF2je3 +etKZToutMD47gRfeAtDiPQEyjwKBgQDD/m86tBMu1o4Qjj2l3/6mwg4XNbh18f0Q +x1v3t4Wu5HROPPHF1HSwVp6iqSS0HhoDgIYVjgqpH4q2urRQ92urHAq56hUV8dn/ +6VprCcAJOTLvu//bu9FXMu4Ys+v915Z6J4oIkEGLwOL4QAUC6dzCM1luEGAirpyf +ePWIMC5d6QKBgQCkHDMcJF+Y7CUJQDRHvOmmIw9bVq5ORJYn8gzyCdEpsi5R5x8G +xI4F9Yv8qEORG9gdPrFUccRo8G5fdi7To+erYR1+/XruHb5GvuOnn+9DcjzARZtK +eY/zoNFvkAUQBsTn8eRe/dJAN6X9WvQq2BX49nj5+RdBJpT9JbAhrxyPEQKBgDvB +Pg5KyrJ0Dbo0c8033r7e2UbwRP4Iulw8O+jpliN9WYxk/l2Pacg9kH4NTbhwmQPK +UpcNyGhJypPtln49ASGZGhgWqzkWlJ12eu+5eEgXnVUEH3zR5YBNcdQsPt4Utbcm +iOoVeTZvp4OCmUSLIpg+6Zwp9/V7ARuJ2GoeLnTJAoGBANOjf4lQBz1/U0aeog/H +OCscSv+pbfHLo778FDJYcEBL0twofifnMLoED2E28F3ptbwUoE89KUrBvvDTgiXj +4Gd5eMU64iKo2utA9crzcxXEhvEyl04fQyZtaqOIfmUHiV5CHV1oCgoa8Rq1Zxc/ +5bzd1lBjif4fuc6RXjooHX+3 +-----END PRIVATE KEY----- diff --git a/certs/public_key.der b/certs/public_key.der index 98507ab7602836a1866c07b492516cde8894cfd3..cc56e52433606f0a8cb5098ec1d082ca9ae4d8d9 100644 GIT binary patch literal 1466 zcmc&z`8(7J7@t#)IfP-D6^e?)cZey+Vj|H&gc+3~ix|dcW^86EV@y10lO$ww460`y zS;W*cZjl&5mXUMEHv5dLR&M23p56B8KiD5X$NPES=Y8G}z=b~txX`=;Cq-7)+tO5rCOuQC=QGoiulo2Q&T6khxyliywSSj4^9sqf$;zY8yxi|WZUw#JD$Z`1&vkie zZB>?Rgq#?PMl+0(x}e#H`|3Jl0H&xqdqvuuCot$@&?}P#r=~QU$fsEC>187grX{Pc z)pxk(4V^>#Zk$Z-bDN4~TZd=f=C!(edS*!!JpyGy(?62c?c<}~_T!2ed{61c~jdi-)tDS9dJ&E?BIr9UcMgAb@7=B(vTwuA}pIT=U1N>^!b96^Piehtg@Tsy77{s`5Kg7M&;p_PG^>1?Q2)& z(`wK)qNcY~Fp29T2`v5fzSw%8w-}KnK2O&Mpx9Z>m7GSikMX&_$4Xiggpkwj{%i;o z3<4L~0X6_)s{^{~VDKgk0)POOZG?uwppYFLKzAFUV45%uQzHcoNeDrlKt6mFcu|Uo z9EL@F`(IlX-1;vt$SXgm3@@H4fmiL`Skbtt*!rZwAu2i@NGaB8S2P%mOZ^ctzIKl_ zIz38{Zc*xSLJy^GI&DxpLAD+Pl=r$!f?gz>7lc=XmQZL8Hax_PlyH zIhBfCACK1jAScD;x;><1g>&Suay|@yfA3w2xqHVNa*fY%RApZoKM)Ng>z;9X?v+dE zr}sN89P|~M@0sgvV!cg%-+fZ&sCJD9QTKJdg<|G#-{PjEYf*!dDlm4@+J`M4I|r|- zMJ)W5j2$6b8ap$tCt<2<7b%(9XViC=!f(HF_}mpDOkWW>@AY|{rn*L&$GxbdAWbNv zdR{Lo-D(O;tMxgw3PD;p-IL@*5+LzQ&lNa*tNGl{V zw$cXL#OpnE4kQlRGg*c*Y-W9Nr%>3n$Rd#hA>Mt>u{tu&ygp$%WpYO7d+fn1_RHTa C#C5I! literal 1528 zcmXqLV*O&!#C&G~GZP~dlZbep&9kCgDcioN>laV@x+LG`T$`BzFB_*;n@8JsUPeZ4 zRtAH{DTd+(qHN5eEL=Q%p?R5QsYS(!ISNiWrKyJeK*c}_ZXUM8?A-j6VnbB}Ww>rm zMlrFh{G#+!z2wB=lA?Tv^xVYE9KGcHTti+1Zje599u~j+yi^#M1Ipz#-~`FC2{T1R z7>XH)fH=%NyroG%D-|FXDHzC!^BNf&m>OCb85mm{nnj888iTl|Q0`!Lb`z5lasV^3 zGB7tW@iQ1SF>x_9F)=b6ZfBq3>H25+!fx^JvG*KSF)aHi-L^$5c=h@%mzzK4u6&>A zy6^TP=1xzu0TPUFpRK!R=4CJZuPK zyc^SWOhD+W?AFER^H-$@Y4oz6Pu=S%c75MR0i{zS)3%=#Q%K&scZaR{uAG8K$_AlCG|di;w=E zy4&5$J7$E-EPLC%Ea;haO4!CHucPKaNbzkwd&{*#(tznq;?y5Er))o{uAJgFV; z7~9qruL^8FWGC|X{Tu5ZJ3XU6Tc*BU(y~v>cG+L`^HrzMY~FLZc#U(Z(*@;%tzKK_ ztA{QA9#}24M1S`0AB8;^AMZQSb7XnciBF+E`St4q<{U_QvfPw2;8^{Ug|W%Lyk{3Y zaQLUytPmJt+|*f*o?El864Bnm$o5NfLVCf;#pYX|-a6ZNZ%ypNtMlDftq5m(K37uoyYlwT zy-I(CKTJ>N`?R$pWr_itm$=7cR<~JmM2fa@WF+n?5Da>E@huZGBLm}N8v`o?9$>PU z6=r1o&%$KD0M0M6{46ZYOzaH?vLGow7BLo)6IFMTx{qr=o_+G?2G?EY9&e%(o+GC( zU`}4}LHR+ckq$7Q977B_zw3@!kK5F9IeZDQyj(b=px`c1ke0o<( zRP9THl<9M=R#(%a`(}*+r+!)9jxB!oK>Gdk%=JIsGnq~h-JNpGAo;bT$gvRX`xEEo z$|ZWNd@1?)@uu^szv|BE33aExdp2)3GpFXO(4s{bo$PY_@9)25JAc{%Q_D~6yzit6 z!j*qq4c+uT?{f5K>rHny-I%@M@xI=;Nmbj}{JnDua-xNAKVHmsYm3l~Or@T{!(Xml z^$-n65Ze|kZ1`nieWqObKl{4F5AA|9KOd~yTPWuzx2Etb=k-<7elF+_P5HCulf&$* z=QNoNZgv>^88J=pvi$IB9k=T(`AsL5%Gr2{?KN!q(;iSQSX{@jwbNl@gXuvPg__8+ z$(4H7Po^Ht=CYV?C-7#QlAl2C^bg!pM-7eFaL%xaSLQfSIsNF&4h|uC&vkxfv9=T5 zsfjIODBkp8!cI#;)6;hDm$oz5##c<1I?nKExAE*ZCEv|Cw=6v7ETJN4dh$x+VOx{L zu-uwi>fP_E&fD(1es#^YE5}rx%g)=uHP^N#+{)tAx&GaOHlaV@x+LG`T$`BzFB_*;n@8JsUPeZ4 zRtAH{DTd+(qHN5eEL=Q%p?R5QsYS(!ISNiWrKyJeK*c}_ZXUM8?A-j6VnbB}Ww>rm zMlrFh{G#+!z2wB=lA?Tv^xVYE9KGcHTti+1Zje599u~j+yi^#M1Ipz#-~`FC2{T1R z7>XH)fH=%NyroG%D-|FXDHzC!^BNf&m>OCb85mm{nnj888iTl|Q0`!Lb`z5lasV^3 zGB7tW@iQ1SF>x_9F)=b6ZfBq3>H25+!fx^JvG*KSF)aHi-L^$5c=h@%mzzK4u6&>A zy6^TP=1xzu0TPUFpRK!R=4CJZuPK zyc^SWOhD+W?AFER^H-$@Y4oz6Pu=S%c75MR0i{zS)3%=#Q%K&scZaR{uAG8K$_AlCG|di;w=E zy4&5$J7$E-EPLC%Ea;haO4!CHucPKaNbzkwd&{*#(tznq;?y5Er))o{uAJgFV; z7~9qruL^8FWGC|X{Tu5ZJ3XU6Tc*BU(y~v>cG+L`^HrzMY~FLZc#U(Z(*@;%tzKK_ ztA{QA9#}24M1S`0AB8;^AMZQSb7XnciBF+E`St4q<{U_QvfPw2;8^{Ug|W%Lyk{3Y zaQLUytPmJt+|*f*o?El864Bnm$o5NfLVCf;#pYX|-a6ZNZ%ypNtMlDftq5m(K37uoyYlwT zy-I(CKTJ>N`?R$pWr_itm$=7cR<~JmM2fa@WF+n?5Da>E@huZGBLm}N8v`o?9$>PU z6=r1o&%$KD0M0M6{46ZYOzaH?vLGow7BLo)6IFMTx{qr=o_+G?2G?EY9&e%(o+GC( zU`}4}LHR+ckq$7Q977B_zw3@!kK5F9IeZDQyj(b=px`c1ke0o<( zRP9THl<9M=R#(%a`(}*+r+!)9jxB!oK>Gdk%=JIsGnq~h-JNpGAo;bT$gvRX`xEEo z$|ZWNd@1?)@uu^szv|BE33aExdp2)3GpFXO(4s{bo$PY_@9)25JAc{%Q_D~6yzit6 z!j*qq4c+uT?{f5K>rHny-I%@M@xI=;Nmbj}{JnDua-xNAKVHmsYm3l~Or@T{!(Xml z^$-n65Ze|kZ1`nieWqObKl{4F5AA|9KOd~yTPWuzx2Etb=k-<7elF+_P5HCulf&$* z=QNoNZgv>^88J=pvi$IB9k=T(`AsL5%Gr2{?KN!q(;iSQSX{@jwbNl@gXuvPg__8+ z$(4H7Po^Ht=CYV?C-7#QlAl2C^bg!pM-7eFaL%xaSLQfSIsNF&4h|uC&vkxfv9=T5 zsfjIODBkp8!cI#;)6;hDm$oz5##c<1I?nKExAE*ZCEv|Cw=6v7ETJN4dh$x+VOx{L zu-uwi>fP_E&fD(1es#^YE5}rx%g)=uHP^N#+{)tAx&GaOH-wVj-?L3wtujO)L zeOu+y*5c_e?)<;vl*XgKU!qaBJ9qyXe#U>Pzn*Qsq@nfi=YsY$%Ygl5b1oSvMY2a{ z_pF)pyEfw$>mlXdCreHXN-7>-nYZM*g|CSN?|<(_61{u4Q=8Yw>EF^&$eUQ@@YraL zR@dfN?17ngGp`y;FZgi&`HzKjUEiEP`Lyznd17gZ!>fIt8H3ZZcFIgQ*>hX%yE+py zBLm~&V1qydSzx@#^0A1qh{!R`d)HonAaKIVL!tLB7CiKPI&GzaJV;uZMZ!R=0lNZz zkOE;w#{Vp=2FySTIoN@54-9rjhU9GvE_7uD7j^o`$vm&haK5Hwr8(c{=fy-8u79hH zFPUAC*s*l_|EuTpHf&hB{aIOF)bc?6fKNH66|Tu2K2Y*z|BDAPcg@dd%X1%8?p-$F znA6KAf0u14V()t)@?f!j{u0UkA?Axt_pSR`v)9$*{DU(OjN`gx+XI}vwtW11_q1HmnR6|wPMl9}|2ml~Gh>RD&E02z k!@A<8{Cg(0?LgzV{^+iSB|K}k`K}iYch5VSSiEo%0G8`iy#N3J literal 0 HcmV?d00001 diff --git a/dual-sign-zfs.sh b/dual-sign-zfs.sh new file mode 100755 index 0000000..c7a93a4 --- /dev/null +++ b/dual-sign-zfs.sh @@ -0,0 +1,47 @@ +#!/usr/bin/bash + +set -eoux pipefail + +KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" +SIGNING_KEY_1="/tmp/certs/signing_key_1.pem" +SIGNING_KEY_2="/tmp/certs/signing_key_2.pem" +PUBLIC_CHAIN="/tmp/certs/public_key_chain.pem" + +if [[ "${DUAL_SIGN}" == "true" ]]; then + dnf install -y /var/cache/rpms/kmods/zfs/*.rpm pv + modinfo /usr/lib/modules/"${KERNEL}"/extra/zfs/spl.ko + for module in /usr/lib/modules/"${KERNEL}"/extra/zfs/*.ko*; + do + module_basename=${module:0:-3} + module_suffix=${module: -3} + if [[ "$module_suffix" == ".xz" ]]; then + xz --decompress "$module" + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" + xz -f "${module_basename}" + elif [[ "$module_suffix" == ".gz" ]]; then + gzip -d "$module" + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" + gzip -9f "${module_basename}" + else + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}" + fi + done + rpmrebuild --batch /var/cache/rpms/kmods/zfs/kmod-zfs-*.rpm + rm -rf /usr/lib/modules/"${KERNEL}"/extra + dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*-"${KERNEL}"-*.rpm + for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do + if ! modinfo "${module}"; then + exit 1 + fi + done + mv -f /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*.rpm /var/cache/rpms/kmods/zfs/ +fi + +for RPM in $(find /var/cache/akmods/ -type f -name \*.rpm); do + cp "${RPM}" /var/cache/rpms/kmods/ +done + +find /var/cache/rpms diff --git a/dual-sign.sh b/dual-sign.sh new file mode 100755 index 0000000..d113efc --- /dev/null +++ b/dual-sign.sh @@ -0,0 +1,41 @@ +#!/usr/bin/bash + +set -eoux pipefail + +KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" +SIGNING_KEY_1="/tmp/certs/signing_key_1.pem" +SIGNING_KEY_2="/tmp/certs/signing_key_2.pem" +PUBLIC_CHAIN="/tmp/certs/public_key_chain.pem" + +if [[ "${DUAL_SIGN}" == "true" ]]; then + for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; + do + module_basename=${module:0:-3} + module_suffix=${module: -3} + if [[ "$module_suffix" == ".xz" ]]; then + xz --decompress "$module" + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" + xz -f "${module_basename}" + elif [[ "$module_suffix" == ".gz" ]]; then + gzip -d "$module" + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}" + gzip -9f "${module_basename}" + else + openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap + /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}" + fi + done + find /var/cache/akmods -type f -name \kmod-*.rpm + for RPM in $(find /var/cache/akmods/ -type f -name \kmod-*.rpm); do \ + rpmrebuild --batch "$RPM" + done + rm -rf /usr/lib/modules/"${KERNEL}"/extra + dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*-"${KERNEL}"-*.rpm + for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do + if ! modinfo "${module}" > /dev/null; then + exit 1 + fi + done +fi