Stable Linux mainline builds for Ubuntu

Re:Stable Linux mainline builds for Ubuntu by andrewmackrodt on Friday August 25, 2023 @10:32AM (#37262163)

I used to use https://github.com/berglh/ubuntu-sb-kernel-signing and the mainline tool from cappelikan ppa, I think it worked on even with DKMS modules such as the Nvidia driver. I've since switched to xanmod with secure boot disabled do my memory is a bit hazy on that last point.

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by maurom on Friday August 25, 2023 @10:29AM (#37262132)

It would seem so. Been doing that since a while on my laptop for locally compiled stable kernels from kernel.org.

My hacky script has more lines to fetch the signer name from the kernel (once it's been signed) than to just sign the vmlinux image.

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by Filligree on Friday August 25, 2023 @10:06AM (#37261894)

You say that as though it's easy. I've yet to find an explanation that's shorter than a book.

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by jchw on Friday August 25, 2023 @10:13AM (#37261966)

The truth is, it doesn't necessarily have to be a book long, but much like setting up PKI, it certainly can be.

What we really need is simple tooling that handles just the case of "I want to sign kernels for my own machine(s)".

Of course, some tools do exist for this case, but I'm not aware of one that is totally generic. Lanzaboote for NixOS seems interesting (disclaimer: have not tried.)

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by Filligree on Friday August 25, 2023 @11:07AM (#37262560)

It so happens I'm running NixOS... so thanks a lot for the reference! :D

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by schlarpc on Friday August 25, 2023 @12:06PM (#37263291)

Another option for NixOS is bootspec-secureboot, I'm using it with no real complaints: https://github.com/DeterminateSystems/bootspec-secureboot

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by predictabl3 on Friday August 25, 2023 @04:57PM (#37266941)

Wait, wtf. There's this in addition to lanzaboote? But no mention of it? (And at one point there was another new list with bootspec support, maybe still is)

Please, people, if you release software that overlaps or competes with another existing in the space, take the 3 minutes to write a comparison note or "why this exists". Please.

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by withinboredom on Friday August 25, 2023 @06:28PM (#37267811)

Why should any project have to justify it's existence? Maybe it just scratches an itch?

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by jchw on Friday August 25, 2023 @06:45PM (#37267966)

I will admit though, it being from Determinate Systems makes me wonder why they built it. They're not some hobbyists, they're a company built around making Nix tooling - and one of their most publicized tools, the Determinate Nix Installer, is actually a tool that, obviously, overlaps with existing tools, but has a very clearly stated objective and reason to exist. It seems very likely to me that there is, in fact, a reason for why they built this. If I had to guess, it's probably meant to be simpler, more robust, more elegant, etc. but I'd love to hear about it.

Unfortunately, unlike many of their projects, they don't seem to have a blog post yet for it.

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by predictabl3 on Friday August 25, 2023 @10:41PM (#37269473)

I mean, at the very least, I do this because after I've put time into making something usually because there was a place to improve or a scratch to itch and if I'm releasing something it's because I'm hoping it will be useful to others.

It seems like a natural conclusion to spend a fraction of the energy to author, to detail it's reason to exist.

Anyway, no one owes me anything but I trust that Determinate Systems has a grander vision than I can see, I just want to be clued in, to be honest ;).

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by TacticalCoder on Friday August 25, 2023 @12:54PM (#37264019)

Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense: only having SecureBoot verifying the kernel is okay'ish (and it does work: I tried modifying a single bit from my kernel and the UEFI refused to boot it) but it's not that great if the attacker can still modify the initrd etc.

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by rubicks on Friday August 25, 2023 @03:40PM (#37266165)

I thought "unified image" solved this?

https://wiki.archlinux.org/title/Unified_kernel_image#Prepar...

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by DHowett on Friday August 25, 2023 @03:49PM (#37266238)

Indeed, that is what the parent is referring to when they say this:

> Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense

(It's much more useful to have a link to it, so thank you!)

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by chaosite on Friday August 25, 2023 @01:15PM (#37264346)

The Debian wiki explanation[1] is technical, but it's definitely shorter than a book, and if you're running your own kernels it shouldn't be too difficult.

It gives you the "here, run these commands" version if that's what you want.

[1] https://wiki.debian.org/SecureBoot#MOK_-_Machine_Owner_Key

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by rubicks on Friday August 25, 2023 @03:28PM (#37266060)

Seconded.

Step 0: deploy your own PKI, install certificates on your motherboard firmware, sign your kernel, sign your modules.

Step 0.5: Sign your DKMSs from Broadcom, Nvidia, and Intel.

Step 0.75: Re-sign everything because you missed a step.

[ Parent | on HN ]

Re:Stable Linux mainline builds for Ubuntu by ungamedplayer on Saturday August 26, 2023 @01:56AM (#37270255)

https://wmealing.github.io/signed-kernel-modules.html

Maybe I need to write it a little more clearly, but perhaps that will get you there.

[ Parent | on HN ]