On 06.06.24 17:47, Justin Forbes wrote:
On Thu, Jun 6, 2024 at 9:19 AM Thorsten Leemhuis fedora@leemhuis.info wrote:
On 04.06.24 18:12, Mikhail Gavrilov wrote:
Instruction [1] about building upstream kernel should be updated,
I'd tend to disagree. I think the root of the problem should be fixed, which you...
because since commit 5e6abd7f4dce [2] the Fedora kernel config contain CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"
...describe here. That's because other people will run into the problem elsewhere then using localmodconfig and such -- like it is the case for Debian already: https://docs.kernel.org/admin-guide/quickly-build-trimmed-linux.html#configm...
Did anyone report this to kernel-ark already? Or checked with kernel-ark commit caused this?
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3160 is the commit which introduced it and it is a good change overall.
Thx.
The docs are what should be updated.
Why not do something like "sed -i s!CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem!# CONFIG_SYSTEM_TRUSTED_KEYS is not set" in the %install section (or somewhere else once the kernel was built and the .config put aside for shipping) to ensure things like "make localmodconfig" and "make olddefconfig" work when using the .config from Fedora's kernel as a base (among others for bisecting a upstream bug).
Alternatively: why not ship that file properly in some package that becomes a Requirement? Then things would work for everyone doing the above, too.
Of note, the generated configs in dist-git and the srpm do not have this line, it is only there after we prep, so they do offer a fine place to start.
But all that makes things distro specifc and requires people to known that and read docs (which most of them will not). :-/
Ciao, Thorsten