Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread Josh Boyer
On Fri, May 29, 2015 at 8:40 AM, David Sommerseth dav...@redhat.com wrote: On 28/05/15 17:45, Josh Boyer wrote: On Thu, May 28, 2015 at 11:26 AM, David Sommerseth dav...@redhat.com wrote: Hi, I've started poking into packaging the mhvtl project for Fedora and EPEL. This package also

Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread Sérgio Basto
On Sex, 2015-05-29 at 08:54 -0400, Josh Boyer wrote: On Fri, May 29, 2015 at 8:40 AM, David Sommerseth dav...@redhat.com wrote: On 28/05/15 17:45, Josh Boyer wrote: On Thu, May 28, 2015 at 11:26 AM, David Sommerseth dav...@redhat.com wrote: Hi, I've started poking into packaging

Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread David Sommerseth
On 28/05/15 23:03, David Smith wrote: On 05/28/2015 10:26 AM, David Sommerseth wrote: ... stuff deleted ... Any thoughts or comments to this approach? Anyone got a better idea? Your process looks reasonable. Thanks! Yes, I do know it is not good to have the keying material for the

Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread Josh Boyer
On Fri, May 29, 2015 at 9:19 AM, Sérgio Basto ser...@serjux.com wrote: On Sex, 2015-05-29 at 08:54 -0400, Josh Boyer wrote: On Fri, May 29, 2015 at 8:40 AM, David Sommerseth dav...@redhat.com wrote: On 28/05/15 17:45, Josh Boyer wrote: On Thu, May 28, 2015 at 11:26 AM, David Sommerseth

Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread David Sommerseth
On 28/05/15 17:45, Josh Boyer wrote: On Thu, May 28, 2015 at 11:26 AM, David Sommerseth dav...@redhat.com wrote: Hi, I've started poking into packaging the mhvtl project for Fedora and EPEL. This package also contains a kernel module, which normally works fine - until you hit Secure Boot.

Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread David Sommerseth
On 29/05/15 14:54, Josh Boyer wrote: On Fri, May 29, 2015 at 8:40 AM, David Sommerseth dav...@redhat.com wrote: On 28/05/15 17:45, Josh Boyer wrote: On Thu, May 28, 2015 at 11:26 AM, David Sommerseth dav...@redhat.com wrote: Hi, I've started poking into packaging the mhvtl project for

Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread drago01
On Fri, May 29, 2015 at 5:57 PM, Sérgio Basto ser...@serjux.com wrote: On Sex, 2015-05-29 at 09:28 -0400, Josh Boyer wrote: On Fri, May 29, 2015 at 9:19 AM, Sérgio Basto ser...@serjux.com wrote: On Sex, 2015-05-29 at 08:54 -0400, Josh Boyer wrote: On Fri, May 29, 2015 at 8:40 AM, David

Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread Simon Farnsworth
On Friday 29 May 2015 15:24:24 David Sommerseth wrote: On 28/05/15 23:03, David Smith wrote: snip But really the best solution here is to get the mhvtl kernel module upstream. Agreed, but I'm not sure how keen upstream kernel developers are to carry a driver for virtual tape devices.

Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread Sérgio Basto
On Sex, 2015-05-29 at 09:28 -0400, Josh Boyer wrote: On Fri, May 29, 2015 at 9:19 AM, Sérgio Basto ser...@serjux.com wrote: On Sex, 2015-05-29 at 08:54 -0400, Josh Boyer wrote: On Fri, May 29, 2015 at 8:40 AM, David Sommerseth dav...@redhat.com wrote: On 28/05/15 17:45, Josh Boyer

Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread Josh Boyer
On Fri, May 29, 2015 at 11:57 AM, Sérgio Basto ser...@serjux.com wrote: On Sex, 2015-05-29 at 09:28 -0400, Josh Boyer wrote: On Fri, May 29, 2015 at 9:19 AM, Sérgio Basto ser...@serjux.com wrote: On Sex, 2015-05-29 at 08:54 -0400, Josh Boyer wrote: On Fri, May 29, 2015 at 8:40 AM, David

Re: Secure boot and packaging third-party kernel modules

2015-05-29 Thread David Sommerseth
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 29/05/15 17:04, Simon Farnsworth wrote: On Friday 29 May 2015 15:24:24 David Sommerseth wrote: On 28/05/15 23:03, David Smith wrote: snip But really the best solution here is to get the mhvtl kernel module upstream. Agreed, but I'm not

Re: Secure boot and packaging third-party kernel modules

2015-05-28 Thread David Smith
On 05/28/2015 10:26 AM, David Sommerseth wrote: ... stuff deleted ... Any thoughts or comments to this approach? Anyone got a better idea? Your process looks reasonable. Yes, I do know it is not good to have the keying material for the signing too easily available. So I'm also keen to

Secure boot and packaging third-party kernel modules

2015-05-28 Thread David Sommerseth
Hi, I've started poking into packaging the mhvtl project for Fedora and EPEL. This package also contains a kernel module, which normally works fine - until you hit Secure Boot. So I was wondering how to handle this the best way. AFAIK, there are currently no plans to get the mhvtl.ko kernel

Re: Secure boot and packaging third-party kernel modules

2015-05-28 Thread Josh Boyer
On Thu, May 28, 2015 at 11:26 AM, David Sommerseth dav...@redhat.com wrote: Hi, I've started poking into packaging the mhvtl project for Fedora and EPEL. This package also contains a kernel module, which normally works fine - until you hit Secure Boot. So I was wondering how to handle