kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/init
History
Thorsten Leemhuis ed4ee9639b module: sign with sha512 instead of sha1 by default 
commit f3b93547b9 upstream.

Switch away from using sha1 for module signing by default and use the
more modern sha512 instead, which is what among others Arch, Fedora,
RHEL, and Ubuntu are currently using for their kernels.

Sha1 has not been considered secure against well-funded opponents since
2005[1]; since 2011 the NIST and other organizations furthermore
recommended its replacement[2]. This is why OpenSSL on RHEL9, Fedora
Linux 41+[3], and likely some other current and future distributions
reject the creation of sha1 signatures, which leads to a build error of
allmodconfig configurations:

  80A20474797F0000:error:03000098:digital envelope routines:do_sigver_init:invalid digest:crypto/evp/m_sigver.c:342:
  make[4]: *** [.../certs/Makefile:53: certs/signing_key.pem] Error 1
  make[4]: *** Deleting file 'certs/signing_key.pem'
  make[4]: *** Waiting for unfinished jobs....
  make[3]: *** [.../scripts/Makefile.build:478: certs] Error 2
  make[2]: *** [.../Makefile:1936: .] Error 2
  make[1]: *** [.../Makefile:224: __sub-make] Error 2
  make[1]: Leaving directory '...'
  make: *** [Makefile:224: __sub-make] Error 2

This change makes allmodconfig work again and sets a default that is
more appropriate for current and future users, too.

Link: https://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html [1]
Link: https://csrc.nist.gov/projects/hash-functions [2]
Link: https://fedoraproject.org/wiki/Changes/OpenSSLDistrustsha1SigVer [3]
Signed-off-by: Thorsten Leemhuis <linux@leemhuis.info>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: kdevops <kdevops@lists.linux.dev> [0]
Link: https://github.com/linux-kdevops/linux-modules-kpd/actions/runs/11420092929/job/31775404330 [0]
Link: https://lore.kernel.org/r/52ee32c0c92afc4d3263cea1f8a1cdc809728aff.1729088288.git.linux@leemhuis.info
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-05-02 07:44:25 +02:00
..
calibrate.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
do_mounts.c rootfs: Fix support for rootfstype= when root= is given 2024-01-25 14:52:48 -08:00
do_mounts.h init: add an init_mknod helper 2020-07-31 08:17:54 +02:00
do_mounts_initrd.c Merge branch 'hch.init_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-08-07 09:40:34 -07:00
do_mounts_rd.c init: add an init_unlink helper 2020-07-31 08:17:52 +02:00
init_task.c sched: Introduce task_struct::user_cpus_ptr to track requested affinity 2021-08-20 12:33:00 +02:00
initramfs.c initramfs: avoid filename buffer overrun 2024-12-14 19:50:42 +01:00
Kconfig module: sign with sha512 instead of sha1 by default 2025-05-02 07:44:25 +02:00
main.c init/main.c: Fix potential static_command_line memory overflow 2024-04-27 17:05:28 +02:00
Makefile init: use $(call cmd,) for generating include/generated/compile.h 2021-05-27 04:01:50 +09:00
noinitramfs.c init: move usermodehelper_enable() to populate_rootfs() 2021-09-08 11:50:27 -07:00
version.c kbuild: add an elfnote for whether vmlinux is built with lto 2021-04-25 05:25:42 +09:00