[PATCH][SRU][E/Unstable] UBUNTU: [Packaging] Fix module signing with older modinfo

Seth Forshee seth.forshee at canonical.com
Mon Nov 18 15:39:17 UTC 2019


BugLink: https://bugs.launchpad.net/bugs/1852581

Not all versions of modinfo support the signer field;
specifically, the version in boinic does not. This leaves all
modules unsigned in hwe kernels based on eoan and later. Change
the check to look for the magic string at the end of the module,
which does not rely on any external tools being aware of module
signatures.

Signed-off-by: Seth Forshee <seth.forshee at canonical.com>
---
 debian/rules.d/2-binary-arch.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/debian/rules.d/2-binary-arch.mk b/debian/rules.d/2-binary-arch.mk
index 050f867060cb..070478e010f7 100644
--- a/debian/rules.d/2-binary-arch.mk
+++ b/debian/rules.d/2-binary-arch.mk
@@ -413,12 +413,12 @@ ifneq ($(skipdbg),true)
 	  -name '*.ko' | while read path_module ; do \
 		module="/lib/modules/$${path_module#*/lib/modules/}"; \
 		if [[ -f "$(dbgpkgdir)/usr/lib/debug/$$module" ]] ; then \
-			signer=$$(/sbin/modinfo -F signer "$$path_module"); \
+			signature=$$(tail -c 28 "$$path_module"); \
 			$(CROSS_COMPILE)objcopy \
 				--add-gnu-debuglink=$(dbgpkgdir)/usr/lib/debug/$$module \
 				$$path_module; \
 			if grep -q CONFIG_MODULE_SIG=y $(builddir)/build-$*/.config && \
-			   [ -n "$$signer" ]; then \
+			   [ "$$signature" = "~Module signature appended~" ]; then \
 				$(builddir)/build-$*/scripts/sign-file $(MODHASHALGO) \
 					$(MODSECKEY) \
 					$(MODPUBKEY) \
-- 
2.20.1




More information about the kernel-team mailing list