Skip to content

[main] kernel: Update Mariner cert in kernel keyring #1979

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 24, 2022
Merged

[main] kernel: Update Mariner cert in kernel keyring #1979

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion SPECS-SIGNED/kernel-signed/kernel-signed.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
Summary: Signed Linux Kernel for %{buildarch} systems
Name: kernel-signed-%{buildarch}
Version: 5.15.2.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Mariner
Expand Down Expand Up @@ -153,6 +153,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
%exclude /module_info.ld

%changelog
* Sun Jan 23 2022 Chris Co <[email protected]> - 5.15.2.1-2
- Bump release number to match kernel release

* Thu Jan 06 2022 Rachel Menge <[email protected]> - 5.15.2.1-1
- Update source to 5.15.2.1

Expand Down
5 changes: 4 additions & 1 deletion SPECS/kernel-headers/kernel-headers.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Summary: Linux API header files
Name: kernel-headers
Version: 5.15.2.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Mariner
Expand Down Expand Up @@ -39,6 +39,9 @@ cp -rv usr/include/* /%{buildroot}%{_includedir}
%{_includedir}/*

%changelog
* Sun Jan 23 2022 Chris Co <[email protected]> - 5.15.2.1-2
- Bump release number to match kernel release

* Thu Jan 06 2022 Rachel Menge <[email protected]> - 5.15.2.1-1
- Update source to 5.15.2.1

Expand Down
29 changes: 0 additions & 29 deletions SPECS/kernel-hyperv/cbl-mariner-ca-20210127.pem
View file
Open in desktop

This file was deleted.

29 changes: 29 additions & 0 deletions SPECS/kernel-hyperv/cbl-mariner-ca-20211013.pem
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
-----BEGIN CERTIFICATE-----
MIIFBjCCA+6gAwIBAgITMwAABO5/lN6NQyelHwABAAAE7jANBgkqhkiG9w0BAQsF
ADB5MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH
UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSMwIQYDVQQD
ExpNaWNyb3NvZnQgVGVzdGluZyBQQ0EgMjAxMDAeFw0yMTEwMTQxNzI4MDVaFw0y
MjEwMTMxNzI4MDVaMIGGMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv
bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0
aW9uMTAwLgYDVQQDEydNYXJpbmVyIFNlY3VyZSBCb290KFByb2R1Y3Rpb24gU2ln
bmluZykwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDF45hTHPQAA7yc
6g3iVuqcQKF51ylCynjUySYqqQha2sQzE7tbJ2egVkW4cfY1UbJsm65i2/VGI1OL
Zia4sRwXRN7toRK5aElYfpsghMgGEaCSPs6915BVqO4WX0jxXswqRZ2CPH+evNCC
hQnOqtjvFCqp7aeQ44b/DpZmaMicL/DwbI4925HWGSYa+/Mp1Fs3yGhP5X75+c9v
w4gJ5KoxcOFRmQEt0c7lOclOi5Np5jys7lrrdmPPbjoALERBatiXj8w72LUZu4+I
970/6jqNEkHeGxqVSPRRNIEZubjvRIfg8uULr8k/Kj8TbznCWoGuaT/9yoVbHhqU
KQMJxxFrAgMBAAGjggF3MIIBczATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4E
FgQUtC1rnigJt7kJfP+emwGUuG6Av5UwRQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsT
FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEWMBQGA1UEBRMNNDYwODk3KzQ2ODU5NzAf
BgNVHSMEGDAWgBS/ZaKrb3WjTkWWVwXPOYf0wBUcHDBcBgNVHR8EVTBTMFGgT6BN
hktodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQl
MjBUZXN0aW5nJTIwUENBJTIwMjAxMCgxKS5jcmwwaQYIKwYBBQUHAQEEXTBbMFkG
CCsGAQUFBzAChk1odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRz
L01pY3Jvc29mdCUyMFRlc3RpbmclMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNVHRMB
Af8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCybuv6kmhT2y97FOLRljLCLvQlBL/E
dxKPDYNFhHCKIUd550yUoUW8XIxSYa+Dmx/1+NYS4Nxql7ecuR4g9+4i0DOmNjYO
NY8epPspIpjUd9OAiKNKJSs2303i2TQojXQcZVeTO89bK3pX+spoACGuEVEuWSdL
q+oPDYZwNTKyobj9wHYO6WXJfcdLPlYZghDjR/WNO5bzvzpi2nn/c4OYvMihLNq0
5uNO0IB/zquyAaCKbi15v/PqYos1BsT+Yft4zf8ry17yFVBIqJMa2An6Gex7SNWj
jj1S7uBga3oZcTHvR8xv3fmbwfQMIrZRmZrq8xkySxQV7xea0sE7X/pJ
-----END CERTIFICATE-----
2 changes: 1 addition & 1 deletion SPECS/kernel-hyperv/kernel-hyperv.signatures.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"Signatures": {
"cbl-mariner-ca-20210127.pem": "82363cb44e786353936abc2e2d62d9325cacf2d9e9a8ebaf4221ea30a9e0cd7b",
"cbl-mariner-ca-20211013.pem": "5ef124b0924cb1047c111a0ecff1ae11e6ad7cac8d1d9b40f98f99334121f0b0",
"config": "b175e8277bebfe10679d8efda24256746bfb34e7c414c943b14c600969c8a3ce",
"kernel-5.15.2.1.tar.gz": "4af6adf37dee2281d56abd55195dd71a975e658eabb884b26c79e40338cdfca6",
"sha512hmac-openssl.sh": "02ab91329c4be09ee66d759e4d23ac875037c3b56e5a598e32fd1206da06a27f"
Expand Down
7 changes: 5 additions & 2 deletions SPECS/kernel-hyperv/kernel-hyperv.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
Summary: Linux Kernel optimized for Hyper-V
Name: kernel-hyperv
Version: 5.15.2.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Mariner
Expand All @@ -14,7 +14,7 @@ URL: https://github.com/microsoft/CBL-Mariner-Linux-Kernel
Source0: kernel-%{version}.tar.gz
Source1: config
Source2: sha512hmac-openssl.sh
Source3: cbl-mariner-ca-20210127.pem
Source3: cbl-mariner-ca-20211013.pem
Patch0: 0002-add-linux-syscall-license-info.patch
BuildRequires: audit-devel
BuildRequires: bash
Expand Down Expand Up @@ -255,6 +255,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
%{_includedir}/perf/perf_dlfilter.h

%changelog
* Sun Jan 23 2022 Chris Co <[email protected]> - 5.15.2.1-2
- Rotate Mariner cert

* Thu Jan 06 2022 Rachel Menge <[email protected]> - 5.15.2.1-1
- Update source to 5.15.2.1

Expand Down
29 changes: 0 additions & 29 deletions SPECS/kernel/cbl-mariner-ca-20210127.pem
View file
Open in desktop

This file was deleted.

29 changes: 29 additions & 0 deletions SPECS/kernel/cbl-mariner-ca-20211013.pem
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
-----BEGIN CERTIFICATE-----
MIIFBjCCA+6gAwIBAgITMwAABO5/lN6NQyelHwABAAAE7jANBgkqhkiG9w0BAQsF
ADB5MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH
UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSMwIQYDVQQD
ExpNaWNyb3NvZnQgVGVzdGluZyBQQ0EgMjAxMDAeFw0yMTEwMTQxNzI4MDVaFw0y
MjEwMTMxNzI4MDVaMIGGMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv
bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0
aW9uMTAwLgYDVQQDEydNYXJpbmVyIFNlY3VyZSBCb290KFByb2R1Y3Rpb24gU2ln
bmluZykwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDF45hTHPQAA7yc
6g3iVuqcQKF51ylCynjUySYqqQha2sQzE7tbJ2egVkW4cfY1UbJsm65i2/VGI1OL
Zia4sRwXRN7toRK5aElYfpsghMgGEaCSPs6915BVqO4WX0jxXswqRZ2CPH+evNCC
hQnOqtjvFCqp7aeQ44b/DpZmaMicL/DwbI4925HWGSYa+/Mp1Fs3yGhP5X75+c9v
w4gJ5KoxcOFRmQEt0c7lOclOi5Np5jys7lrrdmPPbjoALERBatiXj8w72LUZu4+I
970/6jqNEkHeGxqVSPRRNIEZubjvRIfg8uULr8k/Kj8TbznCWoGuaT/9yoVbHhqU
KQMJxxFrAgMBAAGjggF3MIIBczATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4E
FgQUtC1rnigJt7kJfP+emwGUuG6Av5UwRQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsT
FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEWMBQGA1UEBRMNNDYwODk3KzQ2ODU5NzAf
BgNVHSMEGDAWgBS/ZaKrb3WjTkWWVwXPOYf0wBUcHDBcBgNVHR8EVTBTMFGgT6BN
hktodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQl
MjBUZXN0aW5nJTIwUENBJTIwMjAxMCgxKS5jcmwwaQYIKwYBBQUHAQEEXTBbMFkG
CCsGAQUFBzAChk1odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRz
L01pY3Jvc29mdCUyMFRlc3RpbmclMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNVHRMB
Af8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCybuv6kmhT2y97FOLRljLCLvQlBL/E
dxKPDYNFhHCKIUd550yUoUW8XIxSYa+Dmx/1+NYS4Nxql7ecuR4g9+4i0DOmNjYO
NY8epPspIpjUd9OAiKNKJSs2303i2TQojXQcZVeTO89bK3pX+spoACGuEVEuWSdL
q+oPDYZwNTKyobj9wHYO6WXJfcdLPlYZghDjR/WNO5bzvzpi2nn/c4OYvMihLNq0
5uNO0IB/zquyAaCKbi15v/PqYos1BsT+Yft4zf8ry17yFVBIqJMa2An6Gex7SNWj
jj1S7uBga3oZcTHvR8xv3fmbwfQMIrZRmZrq8xkySxQV7xea0sE7X/pJ
-----END CERTIFICATE-----
2 changes: 1 addition & 1 deletion SPECS/kernel/kernel.signatures.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"Signatures": {
"cbl-mariner-ca-20210127.pem": "82363cb44e786353936abc2e2d62d9325cacf2d9e9a8ebaf4221ea30a9e0cd7b",
"cbl-mariner-ca-20211013.pem": "5ef124b0924cb1047c111a0ecff1ae11e6ad7cac8d1d9b40f98f99334121f0b0",
"config": "4a9dcc910023e4edbf8c535f4045285a45902147ff5357b2ab5ca047043127fe",
"config_aarch64": "e6b0d9e723c02a65663a98aa2ea6cee9f7c1d66fab2cc8fad54c71aceb16a1ff",
"kernel-5.15.2.1.tar.gz": "4af6adf37dee2281d56abd55195dd71a975e658eabb884b26c79e40338cdfca6",
Expand Down
7 changes: 5 additions & 2 deletions SPECS/kernel/kernel.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
Summary: Linux Kernel
Name: kernel
Version: 5.15.2.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Mariner
Expand All @@ -18,7 +18,7 @@ Source0: kernel-%{version}.tar.gz
Source1: config
Source2: config_aarch64
Source3: sha512hmac-openssl.sh
Source4: cbl-mariner-ca-20210127.pem
Source4: cbl-mariner-ca-20211013.pem
Patch0: 0002-add-linux-syscall-license-info.patch
# Kernel CVEs are addressed by moving to a newer version of the stable kernel.
# Since kernel CVEs are filed against the upstream kernel version and not the
Expand Down Expand Up @@ -373,6 +373,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
%{_sysconfdir}/bash_completion.d/bpftool

%changelog
* Sun Jan 23 2022 Chris Co <[email protected]> - 5.15.2.1-2
- Rotate Mariner cert

* Thu Jan 06 2022 Rachel Menge <[email protected]> - 5.15.2.1-1
- Update source to 5.15.2.1

Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/pkggen_core_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
filesystem-1.1-8.cm2.aarch64.rpm
kernel-headers-5.15.2.1-1.cm2.noarch.rpm
kernel-headers-5.15.2.1-2.cm2.noarch.rpm
glibc-2.34-2.cm2.aarch64.rpm
glibc-devel-2.34-2.cm2.aarch64.rpm
glibc-i18n-2.34-2.cm2.aarch64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/pkggen_core_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
filesystem-1.1-8.cm2.x86_64.rpm
kernel-headers-5.15.2.1-1.cm2.noarch.rpm
kernel-headers-5.15.2.1-2.cm2.noarch.rpm
glibc-2.34-2.cm2.x86_64.rpm
glibc-devel-2.34-2.cm2.x86_64.rpm
glibc-i18n-2.34-2.cm2.x86_64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ intltool-0.51.0-7.cm2.noarch.rpm
itstool-2.0.6-4.cm2.noarch.rpm
kbd-2.2.0-1.cm2.aarch64.rpm
kbd-debuginfo-2.2.0-1.cm2.aarch64.rpm
kernel-headers-5.15.2.1-1.cm2.noarch.rpm
kernel-headers-5.15.2.1-2.cm2.noarch.rpm
kmod-29-1.cm2.aarch64.rpm
kmod-debuginfo-29-1.cm2.aarch64.rpm
kmod-devel-29-1.cm2.aarch64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ intltool-0.51.0-7.cm2.noarch.rpm
itstool-2.0.6-4.cm2.noarch.rpm
kbd-2.2.0-1.cm2.x86_64.rpm
kbd-debuginfo-2.2.0-1.cm2.x86_64.rpm
kernel-headers-5.15.2.1-1.cm2.noarch.rpm
kernel-headers-5.15.2.1-2.cm2.noarch.rpm
kmod-29-1.cm2.x86_64.rpm
kmod-debuginfo-29-1.cm2.x86_64.rpm
kmod-devel-29-1.cm2.x86_64.rpm
Expand Down