APPLIED: [B][F][J][K][L][SRU][RESEND PATCH] UBUNTU: [Packaging] Revoke and rotate to new signing key

[Stefan Bader]

On 19.01.23 16:18, Dimitri John Ledkov wrote:
> BugLink: https://bugs.launchpad.net/bugs/2002812
> 
> Update revocations, which match the next Ubuntu shim v15.7
> revocations. Specifically - revoke certs that were previously
> protected with by-hash revocations, revoke lost/unused certificates.
> 
> Kernels with this patch applied should be signed using ubuntu/4 pro/3
> core/2 signing streams.
> 
> TPM PCR values and measurements will change when changing the signing
> key.
> 
> Signed-off-by: Dimitri John Ledkov <dimitri.ledkov at canonical.com>
> 
> Dimitri John Ledkov (1):
>    UBUNTU: [Packaging] Revoke and rotate to new signing key
> 
>   .../revoked-certs/canonical-uefi-2012-all.pem | 36 ++++----
>   .../revoked-certs/canonical-uefi-2017-all.pem | 86 +++++++++++++++++++
>   .../revoked-certs/canonical-uefi-2018-all.pem | 86 +++++++++++++++++++
>   .../revoked-certs/canonical-uefi-2019-all.pem | 86 +++++++++++++++++++
>   .../canonical-uefi-2021v1-all.pem             | 86 +++++++++++++++++++
>   .../canonical-uefi-2021v2-all.pem             | 86 +++++++++++++++++++
>   .../canonical-uefi-2021v3-all.pem             | 86 +++++++++++++++++++
>   .../canonical-uefi-uc2019-all.pem             | 86 +++++++++++++++++++
>   debian/rules                                  |  5 ++
>   9 files changed, 625 insertions(+), 18 deletions(-)
>   create mode 100644 debian/revoked-certs/canonical-uefi-2017-all.pem
>   create mode 100644 debian/revoked-certs/canonical-uefi-2018-all.pem
>   create mode 100644 debian/revoked-certs/canonical-uefi-2019-all.pem
>   create mode 100644 debian/revoked-certs/canonical-uefi-2021v1-all.pem
>   create mode 100644 debian/revoked-certs/canonical-uefi-2021v2-all.pem
>   create mode 100644 debian/revoked-certs/canonical-uefi-2021v3-all.pem
>   create mode 100644 debian/revoked-certs/canonical-uefi-uc2019-all.pem
> 

Applied to kinetic,jammy,focal,bionic:linux/master-prep. Also applied a backport 
(context adaption on rules) to jammy:linux-hwe-5.17. Something similar will have 
to be done for jammy:linux-oem-6.[01] and focal:linux-oem-5.14. Thanks.

-Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20230120/5dd88b77/attachment.sig>