kernel: Update Mariner cert in kernel keyring

[christopherco]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/tools/cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./SPECS/LICENSES-AND-NOTICES/data/licenses.json, ./SPECS/LICENSES-AND-NOTICES/LICENSES-MAP.md, ./SPECS/LICENSES-AND-NOTICES/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Our signing key has been renewed so this change updates the trusted module key in the kernel keyring to the new certificate. This will allow kernel modules signed with the new key to be loaded on Mariner starting with this kernel release.

Change Log

• Update the Mariner certificate built which is compiled in at build time
• Bump kernel version numbers

Does this affect the toolchain?

YES

Associated issues

Links to CVEs

Test Methodology

Local build

[rlmenge]

🚢

[adithyaj]

Approved, there were spec linting issues though so just need to fix that

[christopherco]

Approved, there were spec linting issues though so just need to fix that

We typically keep the %define and %global at the top of the file, so we need to update the linter on that. There were a couple other linter issues that I will resolve in an upcoming PR.