Uploaded image for project: 'Lustre'
  1. Lustre
  2. LU-1354

PGP Sign RPM's

Details

    • New Feature
    • Resolution: Unresolved
    • Minor
    • None
    • Lustre 2.7.0, Lustre 2.5.5
    • 10537

    Description

      The current RHEL RPM's as delievered by whamcould are not signed with a PKI certificate. It would be beneficial if Whamcloud could sign the RPM's with PKI to verify that Whamcloud is in fact the author of the RPM's.

      Attachments

        Activity

          [LU-1354] PGP Sign RPM's
          degremoa Aurelien Degremont (Inactive) added a comment -

          By latest, do you mean latest kernel for Ubuntu 20.04 LTS, or kernel on latest Ubuntu 21.04 ?

          degremoa Aurelien Degremont (Inactive) added a comment - By latest, do you mean latest kernel for Ubuntu 20.04 LTS, or kernel on latest Ubuntu 21.04 ?
          simmonsja James A Simmons added a comment -

          Sigh. The latest Ubuntu enforces this now

          [ 4874.368433] Lockdown: insmod: unsigned module loading is restricted; see man kernel_lockdown.7

          simmonsja James A Simmons added a comment - Sigh. The latest Ubuntu enforces this now [ 4874.368433] Lockdown: insmod: unsigned module loading is restricted; see man kernel_lockdown.7
          tperry Tomer Perry made changes -
          Link New: This issue is related to EX-2205 [ EX-2205 ]
          tperry Tomer Perry made changes -
          Link Original: This issue is blocked by EX-2205 [ EX-2205 ]
          tperry Tomer Perry made changes -
          Link New: This issue is blocked by EX-2205 [ EX-2205 ]
          adilger Andreas Dilger made changes -
          Link New: This issue is related to DDN-1648 [ DDN-1648 ]
          jmckenna James McKenna added a comment - - edited

          Bumping this topic. Any news?

          jmckenna James McKenna added a comment - - edited Bumping this topic. Any news?
          degremoa Aurelien Degremont (Inactive) added a comment -

          Is there any news on this topic ?

          degremoa Aurelien Degremont (Inactive) added a comment - Is there any news on this topic ?
          utopiabound Nathaniel Clark made changes -
          Link New: This issue is related to DOE-20 [ DOE-20 ]
          utopiabound Nathaniel Clark added a comment -

          After further investigation. The module signing / cert management is as follows:

          1. During the kernel build, a unique pub/priv key is generated (using info in kernelsource/x509.genkey): 
            kernelsource/signing_key.{x509,priv}
          1. All certificates in kernel source dir (files with the .x509 extension) are signed with the per-kernel key and included in the default trust chain.
          2. All kernel modules are signed with the signing_key and thus any module signed with those would also be acceptable.

          NOTE:
          CentOS does not sign any of the provided kmod-* packaged modules.

          utopiabound Nathaniel Clark added a comment - After further investigation. The module signing / cert management is as follows: During the kernel build, a unique pub/priv key is generated (using info in kernelsource/x509.genkey ): kernelsource/signing_key.{x509,priv} All certificates in kernel source dir (files with the .x509 extension) are signed with the per-kernel key and included in the default trust chain. All kernel modules are signed with the signing_key and thus any module signed with those would also be acceptable. NOTE: CentOS does not sign any of the provided kmod-* packaged modules.

          People

            green Oleg Drokin
            mdidomenico Michael Di Domenico
            Votes:
            1 Vote for this issue
            Watchers:
            17 Start watching this issue

            Dates

              Created:
              Updated: