qiurui/Centos-kernel-stream-10
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git synced 2026-09-09 00:07:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge: redhat/kernel.spec.template: Switch UKI addons back to 504 cert

Browse Source 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3282

JIRA: https://redhat.atlassian.net/browse/RHEL-238666

To make kernel's PCR7 measurement the same when UKI cmdline addons are used
and when they are not, the addons must be signed by the same cert as the
UKI. The switch to 801 was accidential.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>

Approved-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
Approved-by: Jan Stancek <jstancek@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
This commit is contained in:
CKI KWF Bot
2026-08-13 08:29:55 +00:00
parent 68c83cdd8a 15ac746347
commit 67043a4593
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
redhat/kernel.spec.template
+1 -1
View File
@@ -2919,7 +2919,7 @@ BuildKernel() {
mv $KernelUnifiedImage.signed $KernelUnifiedImage
for addon in "$KernelAddonsDirOut"/*; do
%pesign -s -i $addon -o $addon.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n $pesign_name_0
%pesign -s -i $addon -o $addon.signed -a %{secureboot_ca_0} -c %{secureboot_key_uki_0} -n $pesign_name_uki_0
rm -f $addon
mv $addon.signed $addon
done