Hi, Instruction [1] about building upstream kernel should be updated, because since commit 5e6abd7f4dce [2] the Fedora kernel config contain CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem" and this is lead to build error: HOSTCC /home/mikhail/packaging-work/git/linux/tools/bpf/resolve_btfids/ctype.o HOSTCC /home/mikhail/packaging-work/git/linux/tools/bpf/resolve_btfids/str_error_r.o HOSTLD /home/mikhail/packaging-work/git/linux/tools/bpf/resolve_btfids/resolve_btfids-in.o LINK resolve_btfids make[3]: *** No rule to make target 'certs/rhel.pem', needed by 'certs/x509_certificate_list'. Stop. make[3]: *** Waiting for unfinished jobs.... I always use Fedora current kernel config for bisecting upstream kernel. Not sure if my solution is right. But for a quick workaround I decided to remove CONFIG_SYSTEM_TRUSTED_KEYS value.
[1] https://fedoraproject.org/wiki/BuildingUpstreamKernel [2] https://src.fedoraproject.org/rpms/kernel/c/5e6abd7f4dce6f47a9f6df3919ee0810...
diff /boot/config-6.10.0-0.rc1.20240531git4a4be1ad3a6e.22.fc41.x86_64+debug /boot/config-6.10.0-0.rc1.20240529gite0cce98fe279.20.fc41.x86_64+debug
3c3 < # Linux/x86_64 6.10.0-0.rc1.20240531git4a4be1ad3a6e.22.fc41.x86_64+debug Kernel Configuration ---
# Linux/x86_64 6.10.0-0.rc1.20240529gite0cce98fe279.20.fc41.x86_64+debug Kernel Configuration
36c36 < CONFIG_BUILD_SALT="6.10.0-0.rc1.20240531git4a4be1ad3a6e.22.fc41.x86_64" ---
CONFIG_BUILD_SALT="6.10.0-0.rc1.20240529gite0cce98fe279.20.fc41.x86_64"
10745c10745 < CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem" ---
CONFIG_SYSTEM_TRUSTED_KEYS=""
[CCing Justin]
On 04.06.24 18:12, Mikhail Gavrilov wrote:
Instruction [1] about building upstream kernel should be updated,
I'd tend to disagree. I think the root of the problem should be fixed, which you...
because since commit 5e6abd7f4dce [2] the Fedora kernel config contain CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"
...describe here. That's because other people will run into the problem elsewhere then using localmodconfig and such -- like it is the case for Debian already: https://docs.kernel.org/admin-guide/quickly-build-trimmed-linux.html#configm...
Did anyone report this to kernel-ark already? Or checked with kernel-ark commit caused this?
Ciao, Thorsten
On Thu, Jun 6, 2024 at 9:19 AM Thorsten Leemhuis fedora@leemhuis.info wrote:
[CCing Justin]
On 04.06.24 18:12, Mikhail Gavrilov wrote:
Instruction [1] about building upstream kernel should be updated,
I'd tend to disagree. I think the root of the problem should be fixed, which you...
because since commit 5e6abd7f4dce [2] the Fedora kernel config contain CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"
...describe here. That's because other people will run into the problem elsewhere then using localmodconfig and such -- like it is the case for Debian already: https://docs.kernel.org/admin-guide/quickly-build-trimmed-linux.html#configm...
Did anyone report this to kernel-ark already? Or checked with kernel-ark commit caused this?
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3160 is the commit which introduced it and it is a good change overall. The docs are what should be updated. Of note, the generated configs in dist-git and the srpm do not have this line, it is only there after we prep, so they do offer a fine place to start. I will be on limited availability the next week, but will take a look at updating the docs afterwards. Frankly, there is plenty in the doc which needs updating.
Justin
Ciao, Thorsten
On 06.06.24 17:47, Justin Forbes wrote:
On Thu, Jun 6, 2024 at 9:19 AM Thorsten Leemhuis fedora@leemhuis.info wrote:
On 04.06.24 18:12, Mikhail Gavrilov wrote:
Instruction [1] about building upstream kernel should be updated,
I'd tend to disagree. I think the root of the problem should be fixed, which you...
because since commit 5e6abd7f4dce [2] the Fedora kernel config contain CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"
...describe here. That's because other people will run into the problem elsewhere then using localmodconfig and such -- like it is the case for Debian already: https://docs.kernel.org/admin-guide/quickly-build-trimmed-linux.html#configm...
Did anyone report this to kernel-ark already? Or checked with kernel-ark commit caused this?
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3160 is the commit which introduced it and it is a good change overall.
Thx.
The docs are what should be updated.
Why not do something like "sed -i s!CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem!# CONFIG_SYSTEM_TRUSTED_KEYS is not set" in the %install section (or somewhere else once the kernel was built and the .config put aside for shipping) to ensure things like "make localmodconfig" and "make olddefconfig" work when using the .config from Fedora's kernel as a base (among others for bisecting a upstream bug).
Alternatively: why not ship that file properly in some package that becomes a Requirement? Then things would work for everyone doing the above, too.
Of note, the generated configs in dist-git and the srpm do not have this line, it is only there after we prep, so they do offer a fine place to start.
But all that makes things distro specifc and requires people to known that and read docs (which most of them will not). :-/
Ciao, Thorsten
On 07.06.24 08:04, Thorsten Leemhuis wrote:
On 06.06.24 17:47, Justin Forbes wrote:
On Thu, Jun 6, 2024 at 9:19 AM Thorsten Leemhuis fedora@leemhuis.info wrote:
On 04.06.24 18:12, Mikhail Gavrilov wrote:
Instruction [1] about building upstream kernel should be updated,
I'd tend to disagree. I think the root of the problem should be fixed, which you...
because since commit 5e6abd7f4dce [2] the Fedora kernel config contain CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"
...describe here. That's because other people will run into the problem elsewhere then using localmodconfig and such -- like it is the case for Debian already: https://docs.kernel.org/admin-guide/quickly-build-trimmed-linux.html#configm...
Did anyone report this to kernel-ark already? Or checked with kernel-ark commit caused this?
The docs are what should be updated.
Why not do something like "sed -i s!CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem!# CONFIG_SYSTEM_TRUSTED_KEYS is not set" in the %install section (or somewhere else once the kernel was built and the .config put aside for shipping) to ensure things like "make localmodconfig" and "make olddefconfig" work when using the .config from Fedora's kernel as a base (among others for bisecting a upstream bug).
Alternatively: why not ship that file properly in some package that becomes a Requirement? Then things would work for everyone doing the above, too.
Hmm, no reply here. So I put those ideas into a ticket now, maybe I get a reaction there: https://gitlab.com/cki-project/kernel-ark/-/issues/158
Ciao, Thorsten
kernel@lists.fedoraproject.org
-
Justin Forbes -
Mikhail Gavrilov -
Thorsten Leemhuis