From 15ac746347e360f277dc2626a1776ecc436ed117 Mon Sep 17 00:00:00 2001 From: Vitaly Kuznetsov Date: Wed, 12 Aug 2026 13:16:49 +0200 Subject: [PATCH] redhat/kernel.spec.template: Switch UKI addons back to 504 cert JIRA: https://redhat.atlassian.net/browse/RHEL-238666 Upstream Status: RHEL only To make kernel's PCR7 measurement the same when UKI cmdline addons are used and when they are not, the addons must be signed by the same cert as the UKI. The switch to 801 was accidential. Fixes: cbb04858993f ("redhat/kernel.spec.template: Simplify uki-virt signing") Signed-off-by: Vitaly Kuznetsov --- redhat/kernel.spec.template | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template index a7eb65311f51..9315fa1e60ed 100644 --- a/redhat/kernel.spec.template +++ b/redhat/kernel.spec.template @@ -2919,7 +2919,7 @@ BuildKernel() { mv $KernelUnifiedImage.signed $KernelUnifiedImage for addon in "$KernelAddonsDirOut"/*; do - %pesign -s -i $addon -o $addon.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n $pesign_name_0 + %pesign -s -i $addon -o $addon.signed -a %{secureboot_ca_0} -c %{secureboot_key_uki_0} -n $pesign_name_uki_0 rm -f $addon mv $addon.signed $addon done