From 1cc2bb69323a86c570fffefd79d02191f20f3cd1 Mon Sep 17 00:00:00 2001 From: Andrew Lukoshko Date: Wed, 27 Apr 2022 15:24:45 +0000 Subject: [PATCH] AlmaLinux changes --- SOURCES/almalinuxdup1.x509 | Bin 0 -> 995 bytes SOURCES/almalinuxkpatch1.x509 | Bin 0 -> 988 bytes SOURCES/clsecureboot001.cer | Bin 0 -> 1561 bytes SOURCES/x509.genkey | 6 ++-- SPECS/kernel.spec | 66 +++++++++++++++------------------- 5 files changed, 32 insertions(+), 40 deletions(-) create mode 100644 SOURCES/almalinuxdup1.x509 create mode 100644 SOURCES/almalinuxkpatch1.x509 create mode 100644 SOURCES/clsecureboot001.cer diff --git a/SOURCES/almalinuxdup1.x509 b/SOURCES/almalinuxdup1.x509 new file mode 100644 index 0000000000000000000000000000000000000000..29720140fbee0cf2f4cf3f67c8397db54c22f071 GIT binary patch literal 995 zcmXqLV!m(C#B_WCGZP~dlR$FEyqw>8{>5GH$@aZzVZsKyY@Awc9&O)w85y}*84MB( zRSlHkLY$0ZV#TS+rA3(~l@5tHxrsTMd8HM4`9LUCq#US?jpLUwAUK@+1Avi})b8JL?G`5A!XTue=j zj123ZNKRR()t6VrVddXye^5T8T4B~o>%t$eKL;F|{3))^ed>HR7LiW}UMnsA9`^Sw z|573uISJ=GNYzjhqnq{+jdBI(n%NZQ$kw_C6L>+3w=I8uV2*)Ewl9ntQyUZsqn#M?`sVGMzYi z=gbS;?JNHV_Xx}runt`JU4Pfa;3*FZJ04{#v%M^t@KyE4?Pl@!`WDuc5bE zklZtyt7yWkt}nN*mAm(RxR=qtbgIMUp4_|h<7W4H_Wifo9c$3Dv(1hD%*>V__bhsH z-l$3k*H~%lH#B~jIy>yBm-n^%&jh=Dj9lKk|9{Fn=V#f{M?A`R{TUy68OpPSw&}&) Q>Flmr+o@R=wLI}A0G|SZ?f?J) literal 0 HcmV?d00001 diff --git a/SOURCES/almalinuxkpatch1.x509 b/SOURCES/almalinuxkpatch1.x509 new file mode 100644 index 0000000000000000000000000000000000000000..1292610292f7822b62040394efe0fac2dafa694b GIT binary patch literal 988 zcmXqLV!mO}#B^W*GZP~dlYoq&xXS67&Odh=mLz#4otb99%f_kI=F#?@mywa1mBApv zP}M*gF2u zJHGXK1atMXhiz20(loue!mCj*?5S+)#RDlD$_$e9g42(2J*()j?LXwd_Qq-j_n4iZ zX11RcaMIIVoA^YzB~o0EUgs?+etc(|;`beXUHVUU1<(3sS6Fd<=lOpV z*p&^JGchwVFfMNFHfZcHkOu~+tTKy)fmnmcj7x97e`VeDwEz7il}mf(wbtvoO*Rl^ z<4kDtU~K#0#0UicSy-8w89p#V^r?dMv2kd#F|x9RY%q`o@%dQ9SVS_H-F$cXo5IyY53OVsW!wU}qHcagjxS(B1;!U6gMr05Z-?gl z!MfHV%O8|P>|L=(Kl({AMCdaj;r1}Sbw-b<8e8UNn=LD3ZKZyd_5Zf zc~T_azVMYVxR_~K&2wShYrSVIm;8fY^cVPPe@|(Q=m{~?yAiru=IZNHEH7VgTeq=% zLWn9)X<^_p4S< zwz7w`MLnBVe(7q;?A#<1xqF4j&OEp#qbRvS>G+zR!fP|m#$5`0ab$Veg}WOqH5EPk HR-6O?x59Yr literal 0 HcmV?d00001 diff --git a/SOURCES/clsecureboot001.cer b/SOURCES/clsecureboot001.cer new file mode 100644 index 0000000000000000000000000000000000000000..ca9ce5d92a13320a2995ed90f173ea719a132d8f GIT binary patch literal 1561 zcmZ`(Yfuwc6wXbS1jzzo5X>OBh=_zHxtj+9!bnI+p+=zweAJF{O%_-i65K3=V6`P` zg!+Oiw$+NM3{cvRbwp7M9c2G4W9CPDY!P9nY%kz?r;WtSRH=h8 zU|e*l3WsV{DvoP4TGbnDs9{5GAcS5Z!6h(4C{7Uq1bAm>@_|6YFE-;+7(G78M}rNd zop2L0iATV2PECX)*l5Dk>U3O<$HA#wY63bL*TU2^EXQ6+VmX8d(^It7PU5jJhO385 zA`5A%ieN~rfG#CiV@9QqDqzb&l8`jD9Hy((P@^7aCo5+n4C4+6Mny(D>xqpR~zVhEx6umhZ5RVFal3r5M(h>Ej0sf_MTi2%d}hSB1Z;Kcx_Vo?>QeGcGz_P@TPE#k$jU}t{ z=C4WMHPazOp*1PT3fm+ruI6lS_~q`^8L{y-bu+Gf%@__g=3FU^|HN|Z8E=KQmHrw0 zI*CrQY%Us>cb>W=8$P+bYgw+q?~#eYnR*Y9;aJhXnxTwk!v=F7YKwQfz8bV zV01@f!?{5q0>0>7n9VhhK+@rCzjllgEbu48Bs8(uEH~tubc=NhbLDzdL9qcd0ymIeCpOTfNz>=FRp+_ZMjPwTEfKR;4GdG@D`O}rr^ zO(!d6#<-~YhKw(p3S9X|dM{X}bRc;161eWzPCUA!^tNx{O73;zPg)%xE6 literal 0 HcmV?d00001 diff --git a/SOURCES/x509.genkey b/SOURCES/x509.genkey index b1bbe38..4c34491 100644 --- a/SOURCES/x509.genkey +++ b/SOURCES/x509.genkey @@ -5,9 +5,9 @@ prompt = no x509_extensions = myexts [ req_distinguished_name ] -O = Red Hat -CN = Red Hat Enterprise Linux kernel signing key -emailAddress = secalert@redhat.com +O = AlmaLinux +CN = AlmaLinux kernel signing key +emailAddress = security@almalinux.org [ myexts ] basicConstraints=critical,CA:FALSE diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 9a0a8b4..05b4948 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -452,44 +452,36 @@ Source9: x509.genkey %if %{?released_kernel} -Source10: redhatsecurebootca5.cer -Source11: redhatsecurebootca3.cer -Source12: redhatsecureboot501.cer -Source13: redhatsecureboot301.cer -Source14: secureboot_s390.cer -Source15: secureboot_ppc.cer +Source10: clsecureboot001.cer -%define secureboot_ca_0 %{SOURCE11} +%define secureboot_ca_0 %{SOURCE10} %define secureboot_ca_1 %{SOURCE10} %ifarch x86_64 aarch64 -%define secureboot_key_0 %{SOURCE13} -%define pesign_name_0 redhatsecureboot301 -%define secureboot_key_1 %{SOURCE12} -%define pesign_name_1 redhatsecureboot501 +%define secureboot_key_0 %{SOURCE10} +%define pesign_name_0 clsecureboot001 +%define secureboot_key_1 %{SOURCE10} +%define pesign_name_1 clsecureboot001 %endif %ifarch s390x -%define secureboot_key_0 %{SOURCE14} -%define pesign_name_0 redhatsecureboot302 +%define secureboot_key_0 %{SOURCE10} +%define pesign_name_0 clsecureboot001 %endif %ifarch ppc64le -%define secureboot_key_0 %{SOURCE15} -%define pesign_name_0 redhatsecureboot303 +%define secureboot_key_0 %{SOURCE10} +%define pesign_name_0 clsecureboot001 %endif # released_kernel %else -Source11: redhatsecurebootca4.cer -Source12: redhatsecurebootca2.cer -Source13: redhatsecureboot401.cer -Source14: redhatsecureboot003.cer +Source10: clsecureboot001.cer -%define secureboot_ca_0 %{SOURCE12} -%define secureboot_ca_1 %{SOURCE11} -%define secureboot_key_0 %{SOURCE14} -%define pesign_name_0 redhatsecureboot003 -%define secureboot_key_1 %{SOURCE13} -%define pesign_name_1 redhatsecureboot401 +%define secureboot_ca_0 %{SOURCE10} +%define secureboot_ca_1 %{SOURCE10} +%define secureboot_key_0 %{SOURCE10} +%define pesign_name_0 clsecureboot001 +%define secureboot_key_1 %{SOURCE10} +%define pesign_name_1 clsecureboot001 # released_kernel %endif @@ -521,8 +513,8 @@ Source43: generate_bls_conf.sh Source44: mod-internal.list -Source100: rheldup3.x509 -Source101: rhelkpatch1.x509 +Source100: almalinuxdup1.x509 +Source101: almalinuxkpatch1.x509 %if %{with_kabichk} Source200: check-kabi @@ -560,8 +552,8 @@ Patch999999: linux-kernel-test.patch BuildRoot: %{_tmppath}/%{name}-%{KVERREL}-root %description -This is the package which provides the Linux %{name} for Red Hat Enterprise -Linux. It is based on upstream Linux at version %{version} and maintains kABI +This is the package which provides the Linux %{name} for AlmaLinux. +It is based on upstream Linux at version %{version} and maintains kABI compatibility of a set of approved symbols, however it is heavily modified with backports and fixes pulled from newer upstream Linux %{name} releases. This means this is not a %{version} kernel anymore: it includes several components which come @@ -569,7 +561,7 @@ from newer upstream linux versions, while maintaining a well tested and stable core. Some of the components/backports that may be pulled in are: changes like updates to the core kernel (eg.: scheduler, cgroups, memory management, security fixes and features), updates to block layer, supported filesystems, major driver -updates for supported hardware in Red Hat Enterprise Linux, enhancements for +updates for supported hardware in AlmaLinux, enhancements for enterprise customers, etc. # @@ -811,14 +803,14 @@ kernel-gcov includes the gcov graph and source files for gcov coverage collectio %endif %package -n %{name}-abi-stablelists -Summary: The Red Hat Enterprise Linux kernel ABI symbol stablelists +Summary: The AlmaLinux kernel ABI symbol stablelists Group: System Environment/Kernel AutoReqProv: no Obsoletes: %{name}-abi-whitelists < %{rpmversion}-%{pkg_release} Provides: %{name}-abi-whitelists %description -n %{name}-abi-stablelists -The kABI package contains information pertaining to the Red Hat Enterprise -Linux kernel ABI, including lists of kernel symbols that are needed by +The kABI package contains information pertaining to the AlmaLinux +kernel ABI, including lists of kernel symbols that are needed by external Linux kernel modules, and a yum plugin to aid enforcement. %if %{with_kabidw_base} @@ -827,8 +819,8 @@ Summary: The baseline dataset for kABI verification using DWARF data Group: System Environment/Kernel AutoReqProv: no %description kernel-kabidw-base-internal -The package contains data describing the current ABI of the Red Hat Enterprise -Linux kernel, suitable for the kabi-dw tool. +The package contains data describing the current ABI of the AlmaLinux +kernel, suitable for the kabi-dw tool. %endif # @@ -900,7 +892,7 @@ Requires: %{name}%{?1:-%{1}}-modules-uname-r = %{KVERREL}%{?variant}%{?1:+%{1}}\ AutoReq: no\ AutoProv: yes\ %description %{?1:%{1}-}modules-internal\ -This package provides kernel modules for the %{?2:%{2} }kernel package for Red Hat internal usage.\ +This package provides kernel modules for the %{?2:%{2} }kernel package for AlmaLinux internal usage.\ %{nil} # @@ -1747,7 +1739,7 @@ BuildKernel() { # build a BLS config for this kernel %{SOURCE43} "$KernelVer" "$RPM_BUILD_ROOT" "%{?variant}" - # Red Hat UEFI Secure Boot CA cert, which can be used to authenticate the kernel + # AlmaLinux UEFI Secure Boot CA cert, which can be used to authenticate the kernel mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer %ifarch x86_64 aarch64 install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20200609.cer