Am 18.05.23 um 00:41 schrieb Julian Sikorski:
Am 17.05.23 um 23:35 schrieb Julian Sikorski:
> Hello,
>
> I tried building a signed 6.3 kernel today after a while (6.1
> timeframe). Unfortunately, it appears that I am hitting some issues
> with pesign:
>
> + /usr/bin/pesign --certdir /etc/pki/pesign -t 'NSS Certificate DB' -c
> 'Julians Secure Boot signing key - Julian Sikorski' -s -i
> arch/x86/boot/bzImage -o vmlinuz.tmp
> pesign: Could not open NSS database ("security library: bad
> database."): Permission denied
>
> I have updated to F38 since but everything is still in place:
> - pesign is running unlocked:
> $ sudo pesign-client -q
> token "NSS Certificate DB" is unlocked
> - I run mock with hosts's pesign folders exposed:
> $ sudo cat /etc/mock/site-defaults.cfg | grep bind
>
>
config_opts['plugin_conf']['bind_mount_opts']['dirs'].append(('/var/run/pesign',
'/var/run/pesign'))
> - I run mock with --isolation=simple
>
> Summing up, I am still following the same guide as before [1]. Were
> there any changes in the recent months which could influence this
> workflow? Thanks!
>
> Best regards,
> Julian
>
> [1]
https://gist.github.com/chenxiaolong/520914b191f17194a0acdc0e03122e63
> Hi all,
I figured it out, looks like this commit is to blame:
https://github.com/rhboot/pesign/commit/d8a8c259994d0278c59b30b41758a8dd0...
I fixed it by adding myself to pesign group.
Best regards,
Julian
Now with mock-4.0 I am getting permission denied again. I do not want to
be that guy, but aren't incompatible upgrades frowned upon during a
single release?
More importantly, how can I now configure mock so that it can use host's
pesign and I can build signed kernel images again?
Best regards,
Julian