http://bugzilla.opensuse.org/show_bug.cgi?id=1173551 http://bugzilla.opensuse.org/show_bug.cgi?id=1173551#c1 Malte Gell changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |malte.gell@gmx.de --- Comment #1 from Malte Gell --- I usually build my own kernel, based either on the standard Leap kernel sources or from Kernel:stable In both cases, I always use my own key for kernel signing and module signing. This way I do not have to deal with frequently changing keys. I have one key, my own key. But, this requires to build the kernel on my own, every time the kernel gets upgraded. It�s not a big deal to me. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1173551 http://bugzilla.opensuse.org/show_bug.cgi?id=1173551#c3 Takashi Iwai changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tiwai@suse.com --- Comment #3 from Takashi Iwai --- I investigated the issue recently. The rpm macro for building a KMP has already an option to create a cert subpackage, and each KMP may use it. In a nutshell, you need three things for a KMP: 1. Add '# needssslcertforbuild' line at the beginning of the spec file 2. Pass -c %{sourcedir}/_projectcert.crt option to kernel_module_package macro, e.g. %kernel_module_package -p preamble -c %{sourcedir}/_projectcert.crt 3. Add the line below in %install section export BRP_PESIGN_FILES="*.ko" (1) imports the _project.crt file from the OBS project, (2) enables the $PKG-ueficert subpackage creation, and (3) enables the repackaging for signing modules. Many KMPs already have (1) and (3) but no (2). The *-ueficert package installs/deletes the cert file and invokes mokutil just like the kernel package. The obvious problem is, so far, that the procedure above isn't well documented, and the actual usage isn't quite user-friendly. User has to install the *-ueficert package manually if they know it's really needed, and handle MOK deployment later. We definitely need improvement in documentation... Also the cert subpackage is basically superfluous for the KMPs that are shipped with the official cert. So it'd be needed only for downstream KMPs like zfs. -- You are receiving this mail because: You are on the CC list for the bug.