https://github.com/fedora-silverblue/issue-tracker/issues/543#issuecomment-2176613840

GitHub

Boot fails with "vmlinuz has invalid signature" or "bad shim signat...

Current workaround See #543 (comment) Original issue text Describe the bug Trying to rebase an existing SB39 to SB40 fails to boot showing vmlinuz-6.8.1-300.fc40.x86.x64 has invalid signature. you ...

Kyle GospoOP•6/18/24, 7:29 PM

https://bugzilla.redhat.com/show_bug.cgi?id=2150982
https://bugzilla.redhat.com/show_bug.cgi?id=2127995

KKyle Gospo https://github.com/fedora-silverblue/issue-tracker/issues/543#issuecomment-21766...

RoyalOughtness•6/18/24, 7:30 PM

oh god

RoyalOughtness•6/18/24, 7:30 PM

so what's the recommendation for ublue users?

RoyalOughtness•6/18/24, 7:31 PM

i would expect complaints about this to flood in over the next day or two

fiftydinar•6/18/24, 7:35 PM

I don't use secure boot.
I guess I would still need to do this to fix things long-term?

RoyalOughtness•6/18/24, 7:37 PM

im gonna pin 40-20240617 in the recipes for all my images temporarily

KKyle Gospo https://github.com/fedora-silverblue/issue-tracker/issues/543#issuecomment-21766...

antheas•6/18/24, 7:44 PM

this thread >.>

j0rge•6/18/24, 7:46 PM

broken gts, nice.

antheas•6/18/24, 7:47 PM

so they resigned the kernel? whats the problem?

RoyalOughtness•6/18/24, 7:49 PM

@Kyle Gospo is there any change the kernel signer can be added to main so that everyone can benefit?

RRoyalOughtness @Kyle Gospo is there any change the kernel signer can be added to main so that e...

fiftydinar•6/18/24, 7:50 PM

this

RoyalOughtness•6/18/24, 7:50 PM

context: https://github.com/ublue-os/bluefin/pull/1404/files

j0rge•6/18/24, 7:50 PM

https://github.com/ublue-os/kernel-signer

RRoyalOughtness @Kyle Gospo is there any change the kernel signer can be added to main so that e...

Kyle GospoOP•6/18/24, 7:50 PM

Main doesn't have the akmod certs since it doesn't ship any

Kyle GospoOP•6/18/24, 7:51 PM

it can be added to your own projects built from main though, see j0rge's link

j0rge•6/18/24, 7:51 PM

PR build failed btw

Jj0rge PR build failed btw

Kyle GospoOP•6/18/24, 7:51 PM

yeah, failing to pull locally

Kyle GospoOP•6/18/24, 7:51 PM

may need EyeCantCU's eyes

KKyle Gospo it can be added to your own projects built from main though, see j0rge's link

RoyalOughtness•6/18/24, 7:51 PM

yep, it just means every downstream project now has to manage kernel signing

RoyalOughtness•6/18/24, 7:56 PM

and it means that there's a manual step regardless for those projects since we don't have access to the privkey to sign with so a new key would need to be manually imported by users

RoyalOughtness•6/18/24, 7:56 PM

so downstream projects would be more or less left out to dry

RoyalOughtness•6/18/24, 7:56 PM

which like, is well within your right to do

RoyalOughtness•6/18/24, 7:57 PM

but it would be nice not to

Kyle GospoOP•6/18/24, 7:59 PM

unfortunately this is fedora's fuck up, I don't have a quick fix

Kyle GospoOP•6/18/24, 7:59 PM

even for bluefin

KKyle Gospo unfortunately this is fedora's fuck up, I don't have a quick fix

RoyalOughtness•6/18/24, 7:59 PM

i know. also wait shouldn't you be signing the kernel with the existing key?

RoyalOughtness•6/18/24, 7:59 PM

if you use the akmods key won't bluefin users need to reimport?

RRoyalOughtness i know. also wait shouldn't you be signing the kernel with the existing key?

Kyle GospoOP•6/18/24, 7:59 PM

bazzite does (and so far is immune to this issue)

Kyle GospoOP•6/18/24, 7:59 PM

bluefin and main on stock fedora kernel leave the keys alone

Kyle GospoOP•6/18/24, 7:59 PM

and only sign the akmods

Kyle GospoOP•6/18/24, 7:59 PM

so most people have this key enrolled already for akmods

RoyalOughtness•6/18/24, 7:59 PM

yikes, so bluefin users will still see this issue unless they manually import?

Kyle GospoOP•6/18/24, 8:00 PM

those that don't will continue to see the issue

RoyalOughtness•6/18/24, 8:00 PM

oh I see

KKyle Gospo those that don't will continue to see the issue

RoyalOughtness•6/18/24, 8:00 PM

wait, this is the same as the secureboot key https://github.com/ublue-os/config/blob/main/build/ublue-os-just/00-default.just

RRoyalOughtness wait, this *is* the same as the secureboot key <https://github.com/ublue-os/conf...

Kyle GospoOP•6/18/24, 8:01 PM

yes, the kernel is signed with fedora's key (valid anywhere you'd find secure boot)

Kyle GospoOP•6/18/24, 8:01 PM

and the akmods are signed with the akmod key (required for akmods to load under secure boot)

Kyle GospoOP•6/18/24, 8:01 PM

change is to also sign the kernel with the akmod key

KKyle Gospo and the akmods are signed with the akmod key (required for akmods to load under ...

RoyalOughtness•6/18/24, 8:01 PM

right, so this could still be added to main to help downstream projects, despite not having a reason to be in main until this point

Kyle GospoOP•6/18/24, 8:01 PM

potentially, yes

RoyalOughtness•6/18/24, 8:02 PM

i get that you don't have to

Kyle GospoOP•6/18/24, 8:02 PM

would require pulling the akmod key into main and porting this over

Kyle GospoOP•6/18/24, 8:02 PM

right now that key is not present

RoyalOughtness•6/18/24, 8:02 PM

if I had access to your privkey, then i could put that into my repos

RoyalOughtness•6/18/24, 8:02 PM

but i cant

RoyalOughtness•6/18/24, 8:02 PM

and you shouldnt give it to me

RoyalOughtness•6/18/24, 8:03 PM

downstream image users that use nvidia/asus/hwe already have this imported thankfully, so adding it to main would make it uniform

RRoyalOughtness downstream image users that use nvidia/asus/hwe already have this imported thank...

Kyle GospoOP•6/18/24, 8:03 PM

yeah, and hwe

KKyle Gospo right now that key is not present

bsherman•6/18/24, 8:04 PM

actually, the secure boot signing key (AND our cosign key) is an org global secrets, so we could use it in main if the choice was made to sign the whole kernel there, but i'm not yet convinced we should do so, even if it is the right choice for bluefin

Bbsherman actually, the secure boot signing key (AND our cosign key) is an org global secr...

Kyle GospoOP•6/18/24, 8:04 PM

the signing action has a self-check

https://github.com/fedora-silverblue/issue-tracker/issues/543#issuecomment-2176613840

Similar Threads

Similar Threads

Similar Threads