berglh / ubuntu-sb-kernel-signing

Ubuntu Secure Boot Kernel Signing (MOK)
MIT License
126 stars 23 forks source link

Add a separate script for Liqourix kernel signing #5

Open berglh opened 2 years ago

berglh commented 2 years ago

It might be desirable to only sign Liqourix kernels with a dedicated script. If someone is interested in this, please add your comment to register your interest.

przemoc commented 8 months ago

Recently mainline Ubuntu kernels bumped dependencies from: libc6 (>= 2.34) as seen in: linux-headers-6.1.76-060176-generic_6.1.76-060176.202402010036_amd64.deb to: libc6 (>= 2.38) as seen starting from: linux-headers-6.1.77-060177-generic_6.1.77-060177.202402052037_amd64.deb which is a consequence of: https://wiki.ubuntu.com/Kernel/MainlineBuilds#Mainline_kernel_build_toolchain

Mainline kernel build toolchain

These kernels are built with the toolchain (gcc, g++, etc.) from either the most recent Ubuntu stable release or development release, at the discretion of the Kernel Team. (21.10 "Impish Indri" and 22.04 "J. J." respectively, as of October 2021) Therefore, out-of-tree kernel modules you already have built and installed for use with your release kernels on LTS releases are not likely to work with the mainline builds (unless the LTS release is also the most recent release, a/k/a from Late April to Late October in even-numbered years).

and makes quick and easy installation of more recent kernels on 22.04 (jammy) no longer possible (if one needs headers for DKMS modules).

(Old related bug: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1926938)

There is:

but it seems to be behind a few kernel releases.

Liquorix Kernel:

seems more up-to-date and feels like a good thing to support out-of-the-box by ubuntu-sb-kernel-signing.


Thank you for your project, it's useful. Just wanted to express my vote that Liqourix kernel dedicated signing script would be good to have. (I do think that zz-signing for signing any kernel is too risky to use.)