diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-04-28 16:25:48 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-04-28 16:27:36 +0200 |
| commit | a29a2dfa0fa34743508664ca3d0564a923f904d5 (patch) | |
| tree | 8d2434266b13f9299c1d37f5c902d122da6f80e6 | |
| parent | d1bfa067311a6fdc992765b0bb8c8ff995e1104f (diff) | |
| download | vyos-build-a29a2dfa0fa34743508664ca3d0564a923f904d5.tar.gz vyos-build-a29a2dfa0fa34743508664ca3d0564a923f904d5.zip | |
Kernel: T861: add custom VyOS CA to Kernel builds for later module signing
With this addition we can always sign a Kernel module later and ship it if
needed, without re-compiling the Kernel.
Kernel will report:
[ 1.223891] Loaded X.509 cert 'VyOS Networks Secure Boot Signer 2025 - linux: 6ca57e2add335babd08da69b48c70693edd2b037'
Issuer: CN = VyOS Networks Secure Boot CA
Validity
Not Before: Apr 26 09:07:06 2025 GMT
Not After : Apr 24 09:07:06 2035 GMT
Subject: CN = VyOS Networks Secure Boot Signer 2025 - linux
| -rw-r--r-- | data/certificates/vyos-prod-2025-linux.pem | 29 | ||||
| -rwxr-xr-x | scripts/package-build/linux-kernel/build-kernel.sh | 2 |
2 files changed, 30 insertions, 1 deletions
diff --git a/data/certificates/vyos-prod-2025-linux.pem b/data/certificates/vyos-prod-2025-linux.pem new file mode 100644 index 00000000..0bbbfd30 --- /dev/null +++ b/data/certificates/vyos-prod-2025-linux.pem @@ -0,0 +1,29 @@ +-----BEGIN CERTIFICATE----- +MIIE5jCCAs4CFGylfirdM1ur0I2mm0jHBpPt0rA3MA0GCSqGSIb3DQEBCwUAMCcx +JTAjBgNVBAMMHFZ5T1MgTmV0d29ya3MgU2VjdXJlIEJvb3QgQ0EwHhcNMjUwNDI2 +MDkwNzA2WhcNMzUwNDI0MDkwNzA2WjA4MTYwNAYDVQQDDC1WeU9TIE5ldHdvcmtz +IFNlY3VyZSBCb290IFNpZ25lciAyMDI1IC0gbGludXgwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQDgsT5x8fUsgCq+FvQlD5+dtcUXnsx+psrbvlX8vaIa +62W2X6+ifPeZmtwGQ2LbVll2/mg2X/Xj4BTjBeiJ+6MDxCjpjALk/15qwaySX4az +AxDOJed/KT5wiw1xyuyvG89Q0PmC+/WDnLd5A8z8C7hJ46obgSS1W6U2XHbA9rVC +3wCucLN5scbz5iQMb1n23eLCDZ2vLeyuXmaWOJGYcE70A4p01HIEJ1veUBdrdHcx +9Lsp8GE29BMauuBjKV3lW4ifB5SaHwr40G1X4Tk1f2ZSlSc3e60iXXkDaDsGB6om +gsLO/C6PZAi7cxseRDTdM8dS7V7AbbHcXzQ7eWUVknL7e7qe9Syoa7P3N0q2HFCR +zpfSc9FrZKCGqbNnx7pB4RPExkEy+EGBxsHNHe023VEs1NFghnx9a83Ti2HeAt0W +7Zcf/66JYEMsJBgqCEAeVKfwTc+/eo7fxw9ga+U2jQA0tBExZ/GHOuIBNx4wJ7++ +BlFBmDzRXF0phjGtkQ9YtCmZoBb87UuDAibTj7gfjNJxzMSxRLbqQDkyab2Jl9R+ +1DHLDn4owp/8LgBckq21KNk/uYpv3smRlF7L07gQl50LieuSsnEBKYRCzofxMDt5 +TH3FpZzze7qxK1zcJQyhK/N8AQJMFL3EyEcRXr9NB1meoDaelSNR8NVBoNzLpHOk +NQIDAQABMA0GCSqGSIb3DQEBCwUAA4ICAQBTdqwHSD7sVe/RukUPPQ60wHk8XQpq +fwuZwCeGwKAFjVhR3WE61DXKH7AiHN6bHDbSbetPEjJ+gJNi5Ozd91/zZY7uM5cZ +V6M7UGprP5Ou36e8PbObZ8hCAog1Ss7syWCJ2y8vFuH+WJeVxMcEweoniPpRcmVi +BYeY1DnpWMhO2SgMOEb5RoiisNyTd9xR+WY1YNB+/7OXtLwJUCnmxlsZHFT9fI8J +F/awm24PcUGUn43nzTCwmXp+mIKLurVvs3tZonFQ7zMvFlId11G0xB4rb+pYl/3O +lOinplf/+jwSwc0jb6g99QNN/vQpq6b3CkGS3zdIeF7s/q1G0IRYHTqrou8avugT +95cZxqhncXPY7PFst/lblJsj095UxlqLLKZ35+TqyTXTHDw9/SrbTabkSdHPitmd +YMB5xu8RkA6g/oMJdCMDG+bDjgdx+gDcce9Lg8HFjdHkpfRxpgEUremeW9nPuIru +eFp5fEGdp+I95ryXcgm8pYY9o+VmGgCgplP8UYu4miRoeGluLp+bq5eM+cwxzh00 +ExCpffkZV7HDid6NEZ4HH9PFQxoikc3BmsPAY3IifUG0cNU3qjLWvPxk09ZXeqIB +8SdrC+euQXdVL/jHeF+53+ZJOLL+rfFGBFaDUOeRGhtTEc80pPzWJZhuIaOVuk1J +mYEC+/oplzyF4g== +-----END CERTIFICATE----- diff --git a/scripts/package-build/linux-kernel/build-kernel.sh b/scripts/package-build/linux-kernel/build-kernel.sh index a0364897..5411494d 100755 --- a/scripts/package-build/linux-kernel/build-kernel.sh +++ b/scripts/package-build/linux-kernel/build-kernel.sh @@ -1,6 +1,7 @@ #!/bin/bash CWD=$(pwd) KERNEL_SRC=linux +GIT_ROOT=$(git rev-parse --show-toplevel) set -e @@ -60,7 +61,6 @@ sed -i -e "s/CN =.*/CN=VyOS Networks build time autogenerated Kernel key/" certs TRUSTED_KEYS_FILE=trusted_keys.pem # start with empty key file echo -n "" > $TRUSTED_KEYS_FILE -GIT_ROOT=$(git rev-parse --show-toplevel) CERTS=$(find ${GIT_ROOT}/data/certificates -name "*.pem" -type f || true) if [ ! -z "${CERTS}" ]; then # add known public keys to Kernel certificate chain |