fixed version available:
https://github.com/dell/dkms/releases/tag/v3.0.9
...
Upstream has fixed this issue.
https://github.com/dell/dkms
...
On Fri, 28 Oct 2022 10:46:54 +0200 Maurizio Avogadro wrote:
> Il 27/10/22 21:56, Siddh Raman Pant ha scritto:
> > I used libsecret (which is used as backend by the Python program named
> > keyring),
> > with the keyring being stored as root (isn't visible outside root in
> > seahorse).
> > Can
Il 27/10/22 21:56, Siddh Raman Pant ha scritto:
I used libsecret (which is used as backend by the Python program named keyring),
with the keyring being stored as root (isn't visible outside root in seahorse).
Can you tell why that may be a bad idea?
It can be a nice solution but I admit I
On Thu, 27 Oct 2022 20:31:47 +0200, Maurizio Avogadro
wrote:> Hi Siddh
>
> since dkms is supposed to run as root, it's not clear to me which keyring is
> the signing key passphrase going to be stored to. I definitely wouldn't
> recommend running Gnome/KDE keyrings as root, and user keyrings
Il 27/10/22 17:38, Siddh Raman Pant ha scritto:
We can use the sign_helper.sh which was used in sign_tool config prior to v3 in
the sign_file config option in /etc/dkms/framework.conf.
Courtesy: https://github.com/dell/dkms/issues/273.
I use it with keyring in the following way:
On Wed, 21 Sep 2022 10:49:46 +0200 Maurizio Avogadro wrote:
> ... and support for MOK keys with a passphrase seem to have disappeared all
> at
> once...
>
> Furthermore, I'm unable to find any documentation on changes regarding module
> signing, and there are no useful comments on config
https://github.com/dell/dkms/issues/266
...
Hi.
I have found the problem why it does not work. It is because of this line:
eval '"$sign_file" sha512 "$mok_signing_key" "$mok_certificate"
"$built_module"'
Here I get hash_algo sha512 signed which doesn't work on my box and my
laptop. If I change this to sha256 secure-boot works as
Modules signed with the new dkms-3.0.6-4 are rejected by the kernel and
I end up at the prompt of initramfs. In my case zfs-modul. The modules
are signed but not accepted. Neither with my own keys nor the ones
created by dkms.
Cheers Holger
Because patching /usr/sbin/dkms after every update quickly gets old, i
found another workaround by putting this into /etc/dkms/framework.conf:
do_signing=1
check_the_mok_key() {
case "${KBUILD_SIGN_PIN-}" in
[Nn][oO])
return 0;;
esac
Today update result
Calcul de la mise à jour…
Le paquet suivant a été installé automatiquement et n'est plus nécessaire :
libmozjs-91-0
Veuillez utiliser « apt autoremove » pour le supprimer.
Les NOUVEAUX paquets suivants seront installés :
libmozjs-102-0 linux-headers-5.19.0-2-amd64
With a git-snashot it looks no different.
...
Hi,
On Wed, Sep 14, 2022 at 09:52:22PM +0200, Holger Schröder wrote:
The patch does not work for me. The modules are signed again with the
patch but at boot time they are not accepted and I end up at the
initramfs prompt. zfs module not loaded in my case.
Note that there have been several
The patch does not work for me. The modules are signed again with the
patch but at boot time they are not accepted and I end up at the
initramfs prompt. zfs module not loaded in my case.
Cheers
Package: dkms
Version: 3.0.6-2
Followup-For: Bug #1019425
Control: tags -1 patch
The dkms script has several flaw that forbid module signing:
- Debian, contrary to ubuntu, does not have kmodsign
sign-file from the kernel should be directly used
- the script logic was wrong (if [[ -x
Package: dkms
Version: 3.0.6-2
Severity: important
Dear Maintainer,
With dkms 3.0.6-2 the modules are no longer signed. This means that secure-boot
no longer works.
Back to 3.0.3-4 and and signing works again.
Cheers Holger...
-- System Information:
Debian Release: bookworm/sid
APT prefers
17 matches
Mail list logo
