[Group.of.nepali.translators] [Bug 1945527] Re: Update tzdata to version 2021a-2

2021-10-04 Thread Brian Murray
tzdata (2021a-2ubuntu1) impish; urgency=medium

  * Merge from Debian unstable. Remaining changes:
- Ship ICU timezone data files which are utilized by php and update them
  to 2021a1.

tzdata (2021a-2) unstable; urgency=critical

  * Set urgency to critical as the Samoa DST change is already effective.
  * Update Provides to tzdata-bookworm.
  * debian/control: remove Adam Conrad from Uploaders. RIP.  Closes: #986954.
  * Cherry-pick patches from tadata-2021b until the upstream situation gets
less confused:
- 01-no-leap-second-2021-12-31.patch: No leap second on 2021-12-31 as per
  IERS Bulletin C 62.
- 02-samoa-dst.patch: Samoa no longer observes DST.
- 03-jordan-dst.patch: Jordan now starts DST on February's last Thursday.

 -- Brian Murray   Wed, 29 Sep 2021 12:14:22 -0700

** Changed in: tzdata (Ubuntu)
   Status: New => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1945527

Title:
  Update tzdata to version 2021a-2

Status in tzdata package in Ubuntu:
  Fix Released
Status in tzdata source package in Xenial:
  New
Status in tzdata source package in Bionic:
  In Progress
Status in tzdata source package in Focal:
  In Progress
Status in tzdata source package in Hirsute:
  In Progress

Bug description:
  New upstream version affecting the following timestamp:

  $region/$timezone = Pacific/Apia

  Verification is done with 'zdump'. The first timezone that gets
  changed in the updated package is dumped with 'zdump -v
  $region/$timezone_that_changed' (this needs to be greped for in
  /usr/share/zoneinfo/). [For example: 'zdump -v Pacific/Apia'.] This is
  compared to the same output after the updated package got installed.
  If those are different the verification is considered done.

  [Test Case for all releases]
  1) zdump -v Pacific/Apia | grep 2021

  For releases with ICU timezone data verification is done using the following 
with dates before and after the change:
  [Test Case for releases >= 20.04 LTS]
  1) sudo apt-get install python3-icu
  2) python3 -c 'from datetime import datetime; from icu import ICUtzinfo, 
TimeZone; tz = ICUtzinfo(TimeZone.creat eTimeZone('Pacific/Apia')); 
print(str(tz.utcoffset(datetime(2021, 9, 26'

  Additionally, an upstream update of tzdata removed the 'old' SystemV
  timezones, so we should ensure that they are kept in Ubuntu 20.04 LTS
  and earlier releases. Subsequently, these should be checked for using
  the following:

  [Test Case for releases <= 20.04 LTS]
  diff <(zdump -v America/Phoenix | cut -d' ' -f2-) <(zdump -v SystemV/MST7 | 
cut -d' ' -f2-)

  Nothing should be returned by the above command.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tzdata/+bug/1945527/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1944914] Re: xenial/linux-azure: 4.15.0-1125.138~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/promote-to-proposed
   Status: Fix Committed => Fix Released

** Changed in: kernel-sru-workflow/regression-testing
   Status: New => Confirmed

** Changed in: kernel-sru-workflow/stakeholder-signoff
   Status: New => Confirmed

** Changed in: kernel-sru-workflow/verification-testing
   Status: New => Confirmed

** Changed in: kernel-sru-workflow/regression-testing
   Status: Confirmed => Triaged

** Changed in: kernel-sru-workflow/verification-testing
   Status: Confirmed => Fix Released

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- meta
- main
- signed
sru-review:
- meta
- signed
- main
  kernel-stable-master-bug: 1944916
  packages:
main: linux-azure
meta: linux-meta-azure
signed: linux-signed-azure
- phase: Promote to Proposed
- phase-changed: Monday, 04. October 2021 17:55 UTC
+ phase: Testing
+ phase-changed: Monday, 04. October 2021 18:57 UTC
+ proposed-announcement-sent: true
+ proposed-testing-requested: true
  reason:
-   promote-to-proposed: Pending -- packages copying to Proposed (main:P
- meta:P signed:P)
+   regression-testing: Ongoing -- testing in progress
+   stakeholder-signoff: Pending -- waiting for signoff
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-azure/azure-kernel: bug 1944913
  variant: debs
  versions:
main: 4.15.0-1125.138~16.04.1
meta: 4.15.0.1125.116
signed: 4.15.0-1125.138~16.04.1
source: 4.15.0-1125.138~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944914

Title:
  xenial/linux-azure: 4.15.0-1125.138~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Fix Released
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  Invalid
Status in Kernel SRU Workflow promote-to-proposed series:
  Fix Released
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  Triaged
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Fix Released
Status in Kernel SRU Workflow stakeholder-signoff series:
  Confirmed
Status in Kernel SRU Workflow verification-testing series:
  Fix Released
Status in linux-azure source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- meta
- main
- signed
sru-review:
- meta
- signed
- main
  kernel-stable-master-bug: 1944916
  packages:
main: linux-azure
meta: linux-meta-azure
signed: linux-signed-azure
  phase: Testing
  phase-changed: Monday, 04. October 2021 18:57 UTC
  proposed-announcement-sent: true
  proposed-testing-requested: true
  reason:
regression-testing: Ongoing -- testing in progress
stakeholder-signoff: Pending -- waiting for signoff
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-azure/azure-kernel: bug 1944913
  variant: debs
  versions:
main: 4.15.0-1125.138~16.04.1
meta: 4.15.0.1125.116
signed: 4.15.0-1125.138~16.04.1
source: 4.15.0-1125.138~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944914/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1944914] Re: xenial/linux-azure: 4.15.0-1125.138~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/promote-signing-to-proposed
   Status: New => Invalid

** Changed in: kernel-sru-workflow/promote-to-proposed
   Status: In Progress => Fix Committed

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- meta
- main
- signed
sru-review:
- meta
- signed
- main
  kernel-stable-master-bug: 1944916
  packages:
main: linux-azure
meta: linux-meta-azure
signed: linux-signed-azure
- phase: Ready for Promote to Proposed
- phase-changed: Monday, 04. October 2021 16:00 UTC
+ phase: Promote to Proposed
+ phase-changed: Monday, 04. October 2021 17:55 UTC
  reason:
-   promote-to-proposed: Pending -- ready for review
+   promote-to-proposed: Pending -- packages copying to Signing (main:P
+ meta:P signed:B)
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-azure/azure-kernel: bug 1944913
  variant: debs
  versions:
main: 4.15.0-1125.138~16.04.1
meta: 4.15.0.1125.116
signed: 4.15.0-1125.138~16.04.1
source: 4.15.0-1125.138~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944914

Title:
  xenial/linux-azure: 4.15.0-1125.138~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Fix Released
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  Invalid
Status in Kernel SRU Workflow promote-to-proposed series:
  Fix Committed
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  New
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Fix Released
Status in Kernel SRU Workflow stakeholder-signoff series:
  New
Status in Kernel SRU Workflow verification-testing series:
  New
Status in linux-azure source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- meta
- main
- signed
sru-review:
- meta
- signed
- main
  kernel-stable-master-bug: 1944916
  packages:
main: linux-azure
meta: linux-meta-azure
signed: linux-signed-azure
  phase: Promote to Proposed
  phase-changed: Monday, 04. October 2021 17:55 UTC
  reason:
promote-to-proposed: Pending -- packages copying to Signing (main:P
  meta:P signed:B)
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-azure/azure-kernel: bug 1944913
  variant: debs
  versions:
main: 4.15.0-1125.138~16.04.1
meta: 4.15.0.1125.116
signed: 4.15.0-1125.138~16.04.1
source: 4.15.0-1125.138~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944914/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1944910] Re: xenial/linux-aws-hwe: 4.15.0-1113.120~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/boot-testing
   Status: Incomplete => Fix Released

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
sru-review:
- meta
- main
  kernel-stable-master-bug: 1944911
  packages:
main: linux-aws-hwe
meta: linux-meta-aws-hwe
- phase: Testing
- phase-changed: Thursday, 30. September 2021 18:21 UTC
+ phase: Holding before Promote to Proposed
+ phase-changed: Monday, 04. October 2021 17:27 UTC
  reason:
-   boot-testing: Stalled -- testing FAILED
+   promote-to-proposed: Holding -- parent tracker not ready for
+ proposed
  synthetic:
:promote-to-as-proposed: Invalid
  variant: debs
  versions:
main: 4.15.0-1113.120~16.04.1
meta: 4.15.0.1113.104
source: 4.15.0-1113.120~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944910

Title:
  xenial/linux-aws-hwe: 4.15.0-1113.120~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Fix Released
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  Invalid
Status in Kernel SRU Workflow promote-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  New
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Fix Released
Status in Kernel SRU Workflow verification-testing series:
  New
Status in linux-aws-hwe source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
sru-review:
- meta
- main
  kernel-stable-master-bug: 1944911
  packages:
main: linux-aws-hwe
meta: linux-meta-aws-hwe
  phase: Holding before Promote to Proposed
  phase-changed: Monday, 04. October 2021 17:27 UTC
  reason:
promote-to-proposed: Holding -- parent tracker not ready for
  proposed
  synthetic:
:promote-to-as-proposed: Invalid
  variant: debs
  versions:
main: 4.15.0-1113.120~16.04.1
meta: 4.15.0.1113.104
source: 4.15.0-1113.120~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944910/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1944914] Re: xenial/linux-azure: 4.15.0-1125.138~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/boot-testing
   Status: Triaged => Fix Released

** Changed in: kernel-sru-workflow/promote-to-proposed
   Status: New => Confirmed

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
+   promote-to-proposed:
+   - meta
+   - main
+   - signed
sru-review:
- meta
- signed
- main
  kernel-stable-master-bug: 1944916
  packages:
main: linux-azure
meta: linux-meta-azure
signed: linux-signed-azure
- phase: Testing
- phase-changed: Thursday, 30. September 2021 21:48 UTC
+ phase: Ready for Promote to Proposed
+ phase-changed: Monday, 04. October 2021 16:00 UTC
  reason:
-   boot-testing: Ongoing -- testing in progress
+   promote-to-proposed: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-azure/azure-kernel: bug 1944913
  variant: debs
  versions:
main: 4.15.0-1125.138~16.04.1
meta: 4.15.0.1125.116
signed: 4.15.0-1125.138~16.04.1
source: 4.15.0-1125.138~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944914

Title:
  xenial/linux-azure: 4.15.0-1125.138~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Fix Released
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-proposed series:
  Confirmed
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  New
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Fix Released
Status in Kernel SRU Workflow stakeholder-signoff series:
  New
Status in Kernel SRU Workflow verification-testing series:
  New
Status in linux-azure source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- meta
- main
- signed
sru-review:
- meta
- signed
- main
  kernel-stable-master-bug: 1944916
  packages:
main: linux-azure
meta: linux-meta-azure
signed: linux-signed-azure
  phase: Ready for Promote to Proposed
  phase-changed: Monday, 04. October 2021 16:00 UTC
  reason:
promote-to-proposed: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-azure/azure-kernel: bug 1944913
  variant: debs
  versions:
main: 4.15.0-1125.138~16.04.1
meta: 4.15.0.1125.116
signed: 4.15.0-1125.138~16.04.1
source: 4.15.0-1125.138~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944914/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1928679] Re: Support importing mokx keys into revocation list from the mok table

2021-10-04 Thread Stefan Bader
** Changed in: linux-hwe-5.8 (Ubuntu)
   Status: New => Invalid

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1928679

Title:
  Support importing mokx keys into revocation list from the mok table

Status in linux package in Ubuntu:
  Fix Released
Status in linux-azure-5.8 package in Ubuntu:
  Invalid
Status in linux-hwe-5.8 package in Ubuntu:
  Invalid
Status in linux-oem-5.10 package in Ubuntu:
  Invalid
Status in linux source package in Xenial:
  New
Status in linux-azure-5.8 source package in Xenial:
  Invalid
Status in linux-hwe-5.8 source package in Xenial:
  Invalid
Status in linux-oem-5.10 source package in Xenial:
  Invalid
Status in linux source package in Bionic:
  New
Status in linux-azure-5.8 source package in Bionic:
  Invalid
Status in linux-hwe-5.8 source package in Bionic:
  Invalid
Status in linux-oem-5.10 source package in Bionic:
  Invalid
Status in linux source package in Focal:
  In Progress
Status in linux-azure-5.8 source package in Focal:
  New
Status in linux-hwe-5.8 source package in Focal:
  In Progress
Status in linux-oem-5.10 source package in Focal:
  Fix Released
Status in linux source package in Hirsute:
  Fix Released
Status in linux-azure-5.8 source package in Hirsute:
  Invalid
Status in linux-hwe-5.8 source package in Hirsute:
  Invalid
Status in linux-oem-5.10 source package in Hirsute:
  Invalid

Bug description:
  [Impact]

   * Ubuntu's 15.4 based shim ships a very large vendor-dbx (aka mokx)
  which revokes many Ubuntu kernel hashes and 2012 signing key.

   * Kernel should import those into it's %:.blacklist keyring such that
  it prohibits signed kexec of the revoked kernels.

   * v5.13-rc1 kernel has learned how to import mokx and how to import
  full certs into the %:.blacklist keyring.

   * However, it only does so by reading MokListXRT efi variable.

   * Due to the large size of Ubuntu's vendor-dbx, shim does not create
  MokListXRT efi variable, but instead creates MokListXRT1 MokListXRT2
  MokListXRT3 which currently v5.13-rc1 kernel cannot read. Shim also
  exposes MokListXRT via mokvar table, which is easier to parse and
  contains all the revocations in full. Kernel needs a patch to read
  MokListXRT via mokvar table.

   * We have two options on how to proceed from here, either we include
  the same hashes and certs as our vendordbx in in the kernel as
  revocation list, or we fix kernel to read MokListXRT via mokvar table

   * The above is known as CVE-2020-26541

   * Separately it would be nice to add informational dmesg messages
  when revoking signing certificates, as a good indication that signing
  key rotation events have happened and have been applied correctly.

  [Test Plan]

   * Boot kernel with 15.4 based Ubuntu shim

   * Install keyutils package

   * Execute $ sudo keyctl list %:.blacklist it should list in exccess
  of 300+ hash entries. It also must list assymetric Canonical signing
  key from 2012.

   * Separately check dmesg to observe that asymmetric canonical signing
  key from 2012 is revoked.

    * $ sudo ls /sys/firmware/efi/mok-variables
  MokListRT  MokListXRT  SbatLevelRT

  When booted with shim, the mok-variables directory above should exist,
  and contain at least `MokListRT  MokListXRT  SbatLevelRT` files.

  In kernel messages, the CA certificate should be loaded via MOKvar
  table i.e:

     * $ sudo journalctl -b -k | grep -A1 'MOKvar table'
  Sep 27 13:11:04 champion-spaniel kernel: integrity: Loading X.509 
certificate: UEFI:MokListRT (MOKvar table)
  Sep 27 13:11:04 champion-spaniel kernel: integrity: Loaded X.509 cert 
'Canonical Ltd. Master Certificate Authority: 
ad91990bc22ab1f517048c23b6655a268e345a63

  [Where problems could occur]

   * EFI variable storage can be full thus preventing shim to mirror
  efivars and the moktable. On decent hardware this should not happen,
  but has been observed to be corrupted on some older EDKII based OVMF
  instances with small EFI variable storage space (pre-4MB).

  [Other Info]

   * The patches to fix the above have been submitted upstream

  
https://lore.kernel.org/keyrings/20210512153100.285169-1-dimitri.led...@canonical.com/

  
https://lore.kernel.org/keyrings/20210512110302.262104-1-dimitri.led...@canonical.com/

  This will now be submitted as SAUCE patches for the Ubuntu UNSTABLE
  kernel, until accepted upstream.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1928679/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1932029] Re: Support builtin revoked certificates

2021-10-04 Thread Stefan Bader
** Also affects: linux-hwe-5.8 (Ubuntu)
   Importance: Undecided
   Status: New

** Changed in: linux-hwe-5.8 (Ubuntu Xenial)
   Status: New => Invalid

** Changed in: linux-hwe-5.8 (Ubuntu)
   Status: New => Invalid

** Changed in: linux-hwe-5.8 (Ubuntu Focal)
   Importance: Undecided => Medium

** Changed in: linux-hwe-5.8 (Ubuntu Focal)
   Status: New => In Progress

** Changed in: linux-hwe-5.8 (Ubuntu Bionic)
   Status: New => Invalid

** Changed in: linux (Ubuntu Focal)
   Importance: Undecided => Medium

** Changed in: linux (Ubuntu Focal)
   Status: New => In Progress

** Changed in: linux-hwe-5.8 (Ubuntu Hirsute)
   Status: New => Invalid

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1932029

Title:
  Support builtin revoked certificates

Status in linux package in Ubuntu:
  Fix Released
Status in linux-azure-5.8 package in Ubuntu:
  Invalid
Status in linux-hwe-5.8 package in Ubuntu:
  Invalid
Status in linux-oem-5.10 package in Ubuntu:
  Invalid
Status in linux source package in Xenial:
  New
Status in linux-azure-5.8 source package in Xenial:
  Invalid
Status in linux-hwe-5.8 source package in Xenial:
  Invalid
Status in linux-oem-5.10 source package in Xenial:
  Invalid
Status in linux source package in Bionic:
  New
Status in linux-azure-5.8 source package in Bionic:
  Invalid
Status in linux-hwe-5.8 source package in Bionic:
  Invalid
Status in linux-oem-5.10 source package in Bionic:
  Invalid
Status in linux source package in Focal:
  In Progress
Status in linux-azure-5.8 source package in Focal:
  New
Status in linux-hwe-5.8 source package in Focal:
  In Progress
Status in linux-oem-5.10 source package in Focal:
  Fix Released
Status in linux source package in Hirsute:
  Fix Released
Status in linux-azure-5.8 source package in Hirsute:
  Invalid
Status in linux-hwe-5.8 source package in Hirsute:
  Invalid
Status in linux-oem-5.10 source package in Hirsute:
  Invalid

Bug description:
  [Impact]

  Upstream linux kernel now supports configuring built-in revoked
  certificates for the .blacklist keyring.

  Add support in our kernel configuration to have built-in revoked
  certificates.

  Revoke UEFI amd64 & arm64 2012 signing certificate.

  Under UEFI Secureboot with lockdown, shim may attempt to communicate
  revoked certificates to the kernel and depending on how good EFI
  firmware is, this may or may not succeed.

  By having these built-in, it will be prohibited to kexec file_load
  older kernels that were signed with now revoked certificates, however
  one boots.

  [Test Plan]

   * Boot kernel directly, or just with grub, and without shim

   * Check that

  $ sudo keyctl list %:.blacklist

  Contains asymmetric 2012 key.

  [Where problems could occur]

   * Derivative and per-arch kernels may need to revoke different keys,
  thus this should be evaluated on per arch & flavour basis as to which
  keys to revoke.

  [Other Info]

   * In theory, this only needs to be revoked on amd64 and arm64, but
  empty revocation list is not allowed by the kernel configury, thus at
  the moment revoking 2012 UEFI cert for all architectures.

   * an ubuntu kernel team regression test is being added to assert that 
expected revoked certificates have been revoked
  see https://lists.ubuntu.com/archives/kernel-team/2021-August/122986.html

   * Previous reviews

  Unstable & v5.13: https://lists.ubuntu.com/archives/kernel-
  team/2021-June/121362.html

  Hirsute & v5.11: https://lists.ubuntu.com/archives/kernel-
  team/2021-August/122996.html

  Focal & v5.10 (oem): https://lists.ubuntu.com/archives/kernel-
  team/2021-August/123470.html

  Focal & v5.8 (azure): https://lists.ubuntu.com/archives/kernel-
  team/2021-September/124336.html

  Focal & v5.4: https://lists.ubuntu.com/archives/kernel-
  team/2021-October/124497.html

  Bionic & v4.15: TODO

  Xenial & v4.4: TODO

  Trusty & v3.13: TODO

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1932029/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1944922] Re: xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/regression-testing
   Status: Fix Released => Incomplete

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- main
- meta
- signed
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
- phase: Holding before Promote to Updates
- phase-changed: Monday, 04. October 2021 13:14 UTC
+ phase: Testing
+ phase-changed: Monday, 04. October 2021 14:46 UTC
  proposed-announcement-sent: true
  proposed-testing-requested: true
  reason:
-   promote-to-updates: Pending -- snap not yet in candidate
+   regression-testing: Stalled -- testing FAILED
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944922

Title:
  xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Fix Released
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  Invalid
Status in Kernel SRU Workflow promote-to-proposed series:
  Fix Released
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  Incomplete
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Fix Released
Status in Kernel SRU Workflow verification-testing series:
  Fix Released
Status in linux-gcp source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- main
- meta
- signed
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Testing
  phase-changed: Monday, 04. October 2021 14:46 UTC
  proposed-announcement-sent: true
  proposed-testing-requested: true
  reason:
regression-testing: Stalled -- testing FAILED
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944922/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1944922] Re: xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/regression-testing
   Status: Triaged => Fix Released

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- main
- meta
- signed
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
- phase: Testing
- phase-changed: Monday, 04. October 2021 12:27 UTC
+ phase: Holding before Promote to Updates
+ phase-changed: Monday, 04. October 2021 13:14 UTC
  proposed-announcement-sent: true
  proposed-testing-requested: true
  reason:
-   regression-testing: Ongoing -- testing in progress
+   promote-to-updates: Pending -- snap not yet in candidate
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944922

Title:
  xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Fix Released
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  Invalid
Status in Kernel SRU Workflow promote-to-proposed series:
  Fix Released
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  Fix Released
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Fix Released
Status in Kernel SRU Workflow verification-testing series:
  Fix Released
Status in linux-gcp source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- main
- meta
- signed
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Holding before Promote to Updates
  phase-changed: Monday, 04. October 2021 13:14 UTC
  proposed-announcement-sent: true
  proposed-testing-requested: true
  reason:
promote-to-updates: Pending -- snap not yet in candidate
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944922/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1944922] Re: xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/promote-to-proposed
   Status: Fix Committed => Fix Released

** Changed in: kernel-sru-workflow/regression-testing
   Status: New => Confirmed

** Changed in: kernel-sru-workflow/verification-testing
   Status: New => Confirmed

** Changed in: kernel-sru-workflow/regression-testing
   Status: Confirmed => Triaged

** Changed in: kernel-sru-workflow/verification-testing
   Status: Confirmed => Fix Released

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- main
- meta
- signed
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
- phase: Promote to Proposed
- phase-changed: Monday, 04. October 2021 11:31 UTC
+ phase: Testing
+ phase-changed: Monday, 04. October 2021 12:27 UTC
+ proposed-announcement-sent: true
+ proposed-testing-requested: true
  reason:
-   promote-to-proposed: Pending -- packages copying to Proposed (main:P
- meta:P signed:P)
+   regression-testing: Ongoing -- testing in progress
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944922

Title:
  xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Fix Released
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  Invalid
Status in Kernel SRU Workflow promote-to-proposed series:
  Fix Released
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  Triaged
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Fix Released
Status in Kernel SRU Workflow verification-testing series:
  Fix Released
Status in linux-gcp source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- main
- meta
- signed
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Testing
  phase-changed: Monday, 04. October 2021 12:27 UTC
  proposed-announcement-sent: true
  proposed-testing-requested: true
  reason:
regression-testing: Ongoing -- testing in progress
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944922/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1944922] Re: xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/promote-signing-to-proposed
   Status: New => Invalid

** Changed in: kernel-sru-workflow/promote-to-proposed
   Status: In Progress => Fix Committed

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- main
- meta
- signed
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
- phase: Ready for Promote to Proposed
- phase-changed: Monday, 04. October 2021 10:49 UTC
+ phase: Promote to Proposed
+ phase-changed: Monday, 04. October 2021 11:31 UTC
  reason:
-   promote-to-proposed: Pending -- ready for review
+   promote-to-proposed: Ongoing -- packages copying to Signing
+ (signed:B)
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944922

Title:
  xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Fix Released
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  Invalid
Status in Kernel SRU Workflow promote-to-proposed series:
  Fix Committed
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  New
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Fix Released
Status in Kernel SRU Workflow verification-testing series:
  New
Status in linux-gcp source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- main
- meta
- signed
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Promote to Proposed
  phase-changed: Monday, 04. October 2021 11:31 UTC
  reason:
promote-to-proposed: Pending -- packages copying to Signing
  (signed:P)
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944922/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1944922] Re: xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/boot-testing
   Status: Triaged => Fix Released

** Changed in: kernel-sru-workflow/promote-to-proposed
   Status: New => Confirmed

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
+   promote-to-proposed:
+   - main
+   - meta
+   - signed
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
- phase: Testing
- phase-changed: Monday, 04. October 2021 10:01 UTC
+ phase: Ready for Promote to Proposed
+ phase-changed: Monday, 04. October 2021 10:49 UTC
  reason:
-   boot-testing: Ongoing -- testing in progress
-   sru-review: Pending -- ready for review
+   promote-to-proposed: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944922

Title:
  xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Fix Released
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-proposed series:
  Confirmed
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  New
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Fix Released
Status in Kernel SRU Workflow verification-testing series:
  New
Status in linux-gcp source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
promote-to-proposed:
- main
- meta
- signed
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Ready for Promote to Proposed
  phase-changed: Monday, 04. October 2021 10:49 UTC
  reason:
promote-to-proposed: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944922/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1944922] Re: xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

2021-10-04 Thread Andy Whitcroft
** Changed in: kernel-sru-workflow/sru-review
   Status: Confirmed => In Progress

** Changed in: kernel-sru-workflow/sru-review
 Assignee: (unassigned) => Andy Whitcroft (apw)

** Changed in: kernel-sru-workflow/sru-review
   Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944922

Title:
  xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Triaged
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  New
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Fix Released
Status in Kernel SRU Workflow verification-testing series:
  New
Status in linux-gcp source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Testing
  phase-changed: Monday, 04. October 2021 10:01 UTC
  reason:
boot-testing: Ongoing -- testing in progress
sru-review: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944922/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1932029] Re: Support builtin revoked certificates

2021-10-04 Thread Launchpad Bug Tracker
This bug was fixed in the package linux-oem-5.10 - 5.10.0-1049.51

---
linux-oem-5.10 (5.10.0-1049.51) focal; urgency=medium

  * focal/linux-oem-5.10: 5.10.0-1049.50 -proposed tracker (LP:
#1944209)

  * e1000e extremly slow (LP: #1930754)
- SAUCE: e1000e: Separate TGP board type from SPT
- SAUCE: e1000e: Fixing packet loss issues on new platforms

  * CVE-2021-41073
- io_uring: ensure symmetry in handling iter types in loop_rw_iter()

 -- Chia-Lin Kao (AceLan)   Mon, 27 Sep 2021
18:33:36 +0800

** Changed in: linux-oem-5.10 (Ubuntu Focal)
   Status: Fix Committed => Fix Released

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-41073

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1932029

Title:
  Support builtin revoked certificates

Status in linux package in Ubuntu:
  Fix Released
Status in linux-azure-5.8 package in Ubuntu:
  Invalid
Status in linux-oem-5.10 package in Ubuntu:
  Invalid
Status in linux source package in Xenial:
  New
Status in linux-azure-5.8 source package in Xenial:
  Invalid
Status in linux-oem-5.10 source package in Xenial:
  Invalid
Status in linux source package in Bionic:
  New
Status in linux-azure-5.8 source package in Bionic:
  Invalid
Status in linux-oem-5.10 source package in Bionic:
  Invalid
Status in linux source package in Focal:
  New
Status in linux-azure-5.8 source package in Focal:
  New
Status in linux-oem-5.10 source package in Focal:
  Fix Released
Status in linux source package in Hirsute:
  Fix Released
Status in linux-azure-5.8 source package in Hirsute:
  Invalid
Status in linux-oem-5.10 source package in Hirsute:
  Invalid

Bug description:
  [Impact]

  Upstream linux kernel now supports configuring built-in revoked
  certificates for the .blacklist keyring.

  Add support in our kernel configuration to have built-in revoked
  certificates.

  Revoke UEFI amd64 & arm64 2012 signing certificate.

  Under UEFI Secureboot with lockdown, shim may attempt to communicate
  revoked certificates to the kernel and depending on how good EFI
  firmware is, this may or may not succeed.

  By having these built-in, it will be prohibited to kexec file_load
  older kernels that were signed with now revoked certificates, however
  one boots.

  [Test Plan]

   * Boot kernel directly, or just with grub, and without shim

   * Check that

  $ sudo keyctl list %:.blacklist

  Contains asymmetric 2012 key.

  [Where problems could occur]

   * Derivative and per-arch kernels may need to revoke different keys,
  thus this should be evaluated on per arch & flavour basis as to which
  keys to revoke.

  [Other Info]

   * In theory, this only needs to be revoked on amd64 and arm64, but
  empty revocation list is not allowed by the kernel configury, thus at
  the moment revoking 2012 UEFI cert for all architectures.

   * an ubuntu kernel team regression test is being added to assert that 
expected revoked certificates have been revoked
  see https://lists.ubuntu.com/archives/kernel-team/2021-August/122986.html

   * Previous reviews

  Unstable & v5.13: https://lists.ubuntu.com/archives/kernel-
  team/2021-June/121362.html

  Hirsute & v5.11: https://lists.ubuntu.com/archives/kernel-
  team/2021-August/122996.html

  Focal & v5.10 (oem): https://lists.ubuntu.com/archives/kernel-
  team/2021-August/123470.html

  Focal & v5.8 (azure): https://lists.ubuntu.com/archives/kernel-
  team/2021-September/124336.html

  Focal & v5.4: https://lists.ubuntu.com/archives/kernel-
  team/2021-October/124497.html

  Bionic & v4.15: TODO

  Xenial & v4.4: TODO

  Trusty & v3.13: TODO

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1932029/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1928679] Re: Support importing mokx keys into revocation list from the mok table

2021-10-04 Thread Launchpad Bug Tracker
This bug was fixed in the package linux-oem-5.10 - 5.10.0-1049.51

---
linux-oem-5.10 (5.10.0-1049.51) focal; urgency=medium

  * focal/linux-oem-5.10: 5.10.0-1049.50 -proposed tracker (LP:
#1944209)

  * e1000e extremly slow (LP: #1930754)
- SAUCE: e1000e: Separate TGP board type from SPT
- SAUCE: e1000e: Fixing packet loss issues on new platforms

  * CVE-2021-41073
- io_uring: ensure symmetry in handling iter types in loop_rw_iter()

 -- Chia-Lin Kao (AceLan)   Mon, 27 Sep 2021
18:33:36 +0800

** Changed in: linux-oem-5.10 (Ubuntu Focal)
   Status: Fix Committed => Fix Released

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-41073

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1928679

Title:
  Support importing mokx keys into revocation list from the mok table

Status in linux package in Ubuntu:
  Fix Released
Status in linux-azure-5.8 package in Ubuntu:
  Invalid
Status in linux-hwe-5.8 package in Ubuntu:
  New
Status in linux-oem-5.10 package in Ubuntu:
  Invalid
Status in linux source package in Xenial:
  New
Status in linux-azure-5.8 source package in Xenial:
  Invalid
Status in linux-hwe-5.8 source package in Xenial:
  Invalid
Status in linux-oem-5.10 source package in Xenial:
  Invalid
Status in linux source package in Bionic:
  New
Status in linux-azure-5.8 source package in Bionic:
  Invalid
Status in linux-hwe-5.8 source package in Bionic:
  Invalid
Status in linux-oem-5.10 source package in Bionic:
  Invalid
Status in linux source package in Focal:
  In Progress
Status in linux-azure-5.8 source package in Focal:
  New
Status in linux-hwe-5.8 source package in Focal:
  In Progress
Status in linux-oem-5.10 source package in Focal:
  Fix Released
Status in linux source package in Hirsute:
  Fix Released
Status in linux-azure-5.8 source package in Hirsute:
  Invalid
Status in linux-hwe-5.8 source package in Hirsute:
  Invalid
Status in linux-oem-5.10 source package in Hirsute:
  Invalid

Bug description:
  [Impact]

   * Ubuntu's 15.4 based shim ships a very large vendor-dbx (aka mokx)
  which revokes many Ubuntu kernel hashes and 2012 signing key.

   * Kernel should import those into it's %:.blacklist keyring such that
  it prohibits signed kexec of the revoked kernels.

   * v5.13-rc1 kernel has learned how to import mokx and how to import
  full certs into the %:.blacklist keyring.

   * However, it only does so by reading MokListXRT efi variable.

   * Due to the large size of Ubuntu's vendor-dbx, shim does not create
  MokListXRT efi variable, but instead creates MokListXRT1 MokListXRT2
  MokListXRT3 which currently v5.13-rc1 kernel cannot read. Shim also
  exposes MokListXRT via mokvar table, which is easier to parse and
  contains all the revocations in full. Kernel needs a patch to read
  MokListXRT via mokvar table.

   * We have two options on how to proceed from here, either we include
  the same hashes and certs as our vendordbx in in the kernel as
  revocation list, or we fix kernel to read MokListXRT via mokvar table

   * The above is known as CVE-2020-26541

   * Separately it would be nice to add informational dmesg messages
  when revoking signing certificates, as a good indication that signing
  key rotation events have happened and have been applied correctly.

  [Test Plan]

   * Boot kernel with 15.4 based Ubuntu shim

   * Install keyutils package

   * Execute $ sudo keyctl list %:.blacklist it should list in exccess
  of 300+ hash entries. It also must list assymetric Canonical signing
  key from 2012.

   * Separately check dmesg to observe that asymmetric canonical signing
  key from 2012 is revoked.

    * $ sudo ls /sys/firmware/efi/mok-variables
  MokListRT  MokListXRT  SbatLevelRT

  When booted with shim, the mok-variables directory above should exist,
  and contain at least `MokListRT  MokListXRT  SbatLevelRT` files.

  In kernel messages, the CA certificate should be loaded via MOKvar
  table i.e:

     * $ sudo journalctl -b -k | grep -A1 'MOKvar table'
  Sep 27 13:11:04 champion-spaniel kernel: integrity: Loading X.509 
certificate: UEFI:MokListRT (MOKvar table)
  Sep 27 13:11:04 champion-spaniel kernel: integrity: Loaded X.509 cert 
'Canonical Ltd. Master Certificate Authority: 
ad91990bc22ab1f517048c23b6655a268e345a63

  [Where problems could occur]

   * EFI variable storage can be full thus preventing shim to mirror
  efivars and the moktable. On decent hardware this should not happen,
  but has been observed to be corrupted on some older EDKII based OVMF
  instances with small EFI variable storage space (pre-4MB).

  [Other Info]

   * The patches to fix the above have been submitted upstream

  
https://lore.kernel.org/keyrings/20210512153100.285169-1-dimitri.led...@canonical.com/

  
https://lore.kernel.org/keyrings/20210512110302.262104-1-dimitri.l

[Group.of.nepali.translators] [Bug 1944922] Re: xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/prepare-package-signed
   Status: Fix Committed => Fix Released

** Changed in: kernel-sru-workflow/boot-testing
   Status: New => Confirmed

** Changed in: kernel-sru-workflow/boot-testing
   Status: Confirmed => Triaged

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
+ boot-testing-requested: true
  built:
route-entry: 1
  delta:
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
- phase: Packaging
- phase-changed: Monday, 04. October 2021 05:28 UTC
+ phase: Testing
+ phase-changed: Monday, 04. October 2021 10:01 UTC
  reason:
-   :prepare-packages: Pending -- building in ppa (signed:P)
-   prepare-package-signed: Ongoing -- signed package not yet fully
- built
+   boot-testing: Ongoing -- testing in progress
sru-review: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944922

Title:
  xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  Triaged
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Released
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  New
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Confirmed
Status in Kernel SRU Workflow verification-testing series:
  New
Status in linux-gcp source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  boot-testing-requested: true
  built:
route-entry: 1
  delta:
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Testing
  phase-changed: Monday, 04. October 2021 10:01 UTC
  reason:
boot-testing: Ongoing -- testing in progress
sru-review: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944922/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp


[Group.of.nepali.translators] [Bug 1928679] Re: Support importing mokx keys into revocation list from the mok table

2021-10-04 Thread Stefan Bader
** Also affects: linux-hwe-5.8 (Ubuntu)
   Importance: Undecided
   Status: New

** Changed in: linux-hwe-5.8 (Ubuntu Xenial)
   Status: New => Invalid

** Changed in: linux-hwe-5.8 (Ubuntu Bionic)
   Status: New => Invalid

** Changed in: linux-hwe-5.8 (Ubuntu Hirsute)
   Status: New => Invalid

** Changed in: linux-hwe-5.8 (Ubuntu Focal)
   Importance: Undecided => Medium

** Changed in: linux-hwe-5.8 (Ubuntu Focal)
   Status: New => In Progress

** Changed in: linux (Ubuntu Focal)
   Importance: Undecided => Medium

** Changed in: linux (Ubuntu Focal)
   Status: New => In Progress

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1928679

Title:
  Support importing mokx keys into revocation list from the mok table

Status in linux package in Ubuntu:
  Fix Released
Status in linux-azure-5.8 package in Ubuntu:
  Invalid
Status in linux-hwe-5.8 package in Ubuntu:
  New
Status in linux-oem-5.10 package in Ubuntu:
  Invalid
Status in linux source package in Xenial:
  New
Status in linux-azure-5.8 source package in Xenial:
  Invalid
Status in linux-hwe-5.8 source package in Xenial:
  Invalid
Status in linux-oem-5.10 source package in Xenial:
  Invalid
Status in linux source package in Bionic:
  New
Status in linux-azure-5.8 source package in Bionic:
  Invalid
Status in linux-hwe-5.8 source package in Bionic:
  Invalid
Status in linux-oem-5.10 source package in Bionic:
  Invalid
Status in linux source package in Focal:
  In Progress
Status in linux-azure-5.8 source package in Focal:
  New
Status in linux-hwe-5.8 source package in Focal:
  In Progress
Status in linux-oem-5.10 source package in Focal:
  Fix Committed
Status in linux source package in Hirsute:
  Fix Released
Status in linux-azure-5.8 source package in Hirsute:
  Invalid
Status in linux-hwe-5.8 source package in Hirsute:
  Invalid
Status in linux-oem-5.10 source package in Hirsute:
  Invalid

Bug description:
  [Impact]

   * Ubuntu's 15.4 based shim ships a very large vendor-dbx (aka mokx)
  which revokes many Ubuntu kernel hashes and 2012 signing key.

   * Kernel should import those into it's %:.blacklist keyring such that
  it prohibits signed kexec of the revoked kernels.

   * v5.13-rc1 kernel has learned how to import mokx and how to import
  full certs into the %:.blacklist keyring.

   * However, it only does so by reading MokListXRT efi variable.

   * Due to the large size of Ubuntu's vendor-dbx, shim does not create
  MokListXRT efi variable, but instead creates MokListXRT1 MokListXRT2
  MokListXRT3 which currently v5.13-rc1 kernel cannot read. Shim also
  exposes MokListXRT via mokvar table, which is easier to parse and
  contains all the revocations in full. Kernel needs a patch to read
  MokListXRT via mokvar table.

   * We have two options on how to proceed from here, either we include
  the same hashes and certs as our vendordbx in in the kernel as
  revocation list, or we fix kernel to read MokListXRT via mokvar table

   * The above is known as CVE-2020-26541

   * Separately it would be nice to add informational dmesg messages
  when revoking signing certificates, as a good indication that signing
  key rotation events have happened and have been applied correctly.

  [Test Plan]

   * Boot kernel with 15.4 based Ubuntu shim

   * Install keyutils package

   * Execute $ sudo keyctl list %:.blacklist it should list in exccess
  of 300+ hash entries. It also must list assymetric Canonical signing
  key from 2012.

   * Separately check dmesg to observe that asymmetric canonical signing
  key from 2012 is revoked.

    * $ sudo ls /sys/firmware/efi/mok-variables
  MokListRT  MokListXRT  SbatLevelRT

  When booted with shim, the mok-variables directory above should exist,
  and contain at least `MokListRT  MokListXRT  SbatLevelRT` files.

  In kernel messages, the CA certificate should be loaded via MOKvar
  table i.e:

     * $ sudo journalctl -b -k | grep -A1 'MOKvar table'
  Sep 27 13:11:04 champion-spaniel kernel: integrity: Loading X.509 
certificate: UEFI:MokListRT (MOKvar table)
  Sep 27 13:11:04 champion-spaniel kernel: integrity: Loaded X.509 cert 
'Canonical Ltd. Master Certificate Authority: 
ad91990bc22ab1f517048c23b6655a268e345a63

  [Where problems could occur]

   * EFI variable storage can be full thus preventing shim to mirror
  efivars and the moktable. On decent hardware this should not happen,
  but has been observed to be corrupted on some older EDKII based OVMF
  instances with small EFI variable storage space (pre-4MB).

  [Other Info]

   * The patches to fix the above have been submitted upstream

  
https://lore.kernel.org/keyrings/20210512153100.285169-1-dimitri.led...@canonical.com/

  
https://lore.kernel.org/keyrings/20210512110302.262104-1-dimitri.led...@canonical.com/

  This will now be submitted as SAUCE patches for t

[Group.of.nepali.translators] [Bug 1944922] Re: xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/prepare-package
   Status: Fix Committed => Fix Released

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  built:
route-entry: 1
  delta:
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Packaging
  phase-changed: Monday, 04. October 2021 05:28 UTC
  reason:
-   :prepare-packages: Pending -- building in ppa (main:P signed:D)
-   prepare-package: Ongoing -- main package not yet fully built
+   :prepare-packages: Ongoing -- building in ppa (signed:B)
prepare-package-signed: Ongoing -- signed package not yet fully
  built
sru-review: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  built:
route-entry: 1
  delta:
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Packaging
  phase-changed: Monday, 04. October 2021 05:28 UTC
  reason:
-   :prepare-packages: Ongoing -- building in ppa (signed:B)
+   :prepare-packages: Pending -- building in ppa (signed:P)
prepare-package-signed: Ongoing -- signed package not yet fully
  built
sru-review: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944922

Title:
  xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  New
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Committed
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  New
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Confirmed
Status in Kernel SRU Workflow verification-testing series:
  New
Status in linux-gcp source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  built:
route-entry: 1
  delta:
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Packaging
  phase-changed: Monday, 04. October 2021 05:28 UTC
  reason:
:prepare-packages: Pending -- building in ppa (signed:P)
prepare-package-signed: Ongoing -- signed package not yet fully
  built
sru-review: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944922/+subscriptions


___
Mailing

[Group.of.nepali.translators] [Bug 1944922] Re: xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

2021-10-04 Thread Ubuntu Kernel Bot
** Changed in: kernel-sru-workflow/prepare-package-meta
   Status: Fix Committed => Fix Released

** Description changed:

  This bug will contain status and test results related to a kernel source
  (or snap) as stated in the title.
  
  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow
  
  -- swm properties --
  built:
route-entry: 1
  delta:
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Packaging
  phase-changed: Monday, 04. October 2021 05:28 UTC
  reason:
-   :prepare-packages: Pending -- building in ppa (main:B meta:P
- signed:D)
+   :prepare-packages: Ongoing -- building in ppa (main:B signed:D)
prepare-package: Ongoing -- main package not yet fully built
-   prepare-package-meta: Ongoing -- meta package not yet fully built
prepare-package-signed: Ongoing -- signed package not yet fully
  built
sru-review: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1944922

Title:
  xenial/linux-gcp: 4.15.0-1110.124~16.04.1 -proposed tracker

Status in Kernel SRU Workflow:
  In Progress
Status in Kernel SRU Workflow automated-testing series:
  Invalid
Status in Kernel SRU Workflow boot-testing series:
  New
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Committed
Status in Kernel SRU Workflow prepare-package-meta series:
  Fix Released
Status in Kernel SRU Workflow prepare-package-signed series:
  Fix Committed
Status in Kernel SRU Workflow promote-signing-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-proposed series:
  New
Status in Kernel SRU Workflow promote-to-security series:
  Invalid
Status in Kernel SRU Workflow promote-to-updates series:
  New
Status in Kernel SRU Workflow regression-testing series:
  New
Status in Kernel SRU Workflow security-signoff series:
  Invalid
Status in Kernel SRU Workflow sru-review series:
  Confirmed
Status in Kernel SRU Workflow verification-testing series:
  New
Status in linux-gcp source package in Xenial:
  New

Bug description:
  This bug will contain status and test results related to a kernel
  source (or snap) as stated in the title.

  For an explanation of the tasks and the associated workflow see:
https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  -- swm properties --
  built:
route-entry: 1
  delta:
sru-review:
- main
- meta
- signed
  kernel-stable-master-bug: 1944923
  packages:
main: linux-gcp
meta: linux-meta-gcp
signed: linux-signed-gcp
  phase: Packaging
  phase-changed: Monday, 04. October 2021 05:28 UTC
  reason:
:prepare-packages: Ongoing -- building in ppa (main:B signed:D)
prepare-package: Ongoing -- main package not yet fully built
prepare-package-signed: Ongoing -- signed package not yet fully
  built
sru-review: Pending -- ready for review
  synthetic:
:promote-to-as-proposed: Invalid
  trackers:
xenial/linux-gcp/gcp-kernel: bug 1944920
xenial/linux-gcp/gke-kernel: bug 1944921
  variant: debs
  versions:
main: 4.15.0-1110.124~16.04.1
meta: 4.15.0.1110.111
signed: 4.15.0-1110.124~16.04.1
source: 4.15.0-1110.124~16.04.1

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/1944922/+subscriptions


___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp