is there an issue / ticket tracking it?
is there an issue / ticket tracking it?
Rlet me check bugzilla
R
KGitHub
Current workaround See #543 (comment) Original issue text Describe the bug Trying to rebase an existing SB39 to SB40 fails to boot showing vmlinuz-6.8.1-300.fc40.x86.x64 has invalid signature. you ...
Roh god
Rso what's the recommendation for ublue users?
Ri would expect complaints about this to flood in over the next day or two
FI don't use secure boot.
I guess I would still need to do this to fix things long-term?
I guess I would still need to do this to fix things long-term?
Rim gonna pin 40-20240617 in the recipes for all my images temporarily
Athis thread >.>
Jbroken gts, nice. 
Aso they resigned the kernel? whats the problem?
R@Kyle Gospo is there any change the kernel signer can be added to main so that everyone can benefit? 
RJKMain doesn't have the akmod certs since it doesn't ship any
Kit can be added to your own projects built from main though, see j0rge's link
JPR build failed btw
Kyeah, failing to pull locally
Kmay need EyeCantCU's eyes
Ryep, it just means every downstream project now has to manage kernel signing
Rand it means that there's a manual step regardless for those projects since we don't have access to the privkey to sign with so a new key would need to be manually imported by users
Rso downstream projects would be more or less left out to dry
Rwhich like, is well within your right to do
Rbut it would be nice not to
Kunfortunately this is fedora's fuck up, I don't have a quick fix
Keven for bluefin
Ri know. also wait shouldn't you be signing the kernel with the existing key?
Rif you use the akmods key won't bluefin users need to reimport?
Kbazzite does (and so far is immune to this issue)
Kbluefin and main on stock fedora kernel leave the keys alone
Kand only sign the akmods
Kso most people have this key enrolled already for akmods
Ryikes, so bluefin users will still see this issue unless they manually import?
Kthose that don't will continue to see the issue
Roh I see
Rwait, this is the same as the secureboot key https://github.com/ublue-os/config/blob/main/build/ublue-os-just/00-default.just
Kyes, the kernel is signed with fedora's key (valid anywhere you'd find secure boot)
Kand the akmods are signed with the akmod key (required for akmods to load under secure boot)
Kchange is to also sign the kernel with the akmod key
Rright, so this could still be added to main to help downstream projects, despite not having a reason to be in main until this point
Kpotentially, yes
Ri get that you don't have to
Kwould require pulling the akmod key into main and porting this over
Kright now that key is not present
Rif I had access to your privkey, then i could put that into my repos 
Rbut i cant
Rand you shouldnt give it to me
Rdownstream image users that use nvidia/asus/hwe already have this imported thankfully, so adding it to main would make it uniform
