|
Bugzilla – Full Text Bug Listing |
| Summary: | Today's update to grub2-efi is broken. It needs to be pulled. | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE 12.3 | Reporter: | Neil Rickert <nwr10cst-oslnx> |
| Component: | Bootloader | Assignee: | Michael Chang <mchang> |
| Status: | RESOLVED FIXED | QA Contact: | Jiri Srain <jsrain> |
| Severity: | Major | ||
| Priority: | P1 - Urgent | CC: | arvidjaar, glin, mchang, meissner, mls |
| Version: | Final | ||
| Target Milestone: | --- | ||
| Hardware: | x86-64 | ||
| OS: | openSUSE 12.3 | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Neil Rickert
2013-04-11 00:53:47 UTC
I just did pull it. top of changes is ------------------------------------------------------------------- Wed Apr 3 10:56:50 UTC 2013 - mchang@suse.com - refresh grub2-secureboot-chainloader.patch: Fix wrongly aligned buffer address (bnc#811608) ------------------------------------------------------------------- Mon Mar 25 17:37:59 UTC 2013 - dvaleev@suse.com - extraconfigure macro is not defined on ppc ------------------------------------------------------------------- Sat Mar 23 18:31:07 UTC 2013 - arvidjaar@gmail.com - corretly set chainloaded image device handle in secure boot mode (bnc#809038) (modified grub2-secureboot-chainloader.patch) The test binaries still live in openSUSE:Maintenance:1528 http://download.opensuse.org/repositories/openSUSE:/Maintenance:/1528/openSUSE_12.3_Update_standard/ if someone wants to check. Could maintenance team check the sign key is correct? Looks like the efi loader is not signed by SUSE Secureboot CA ...? Confirmed that it's not signed by "openSUSE Secure Boot CA" but openSUSE:Maintenance OBS Project. :( output from pesign -S --------------------------------------------- Content was not encrypted. Content is detached; signature cannot be verified. The signer's common name is openSUSE:Maintenance OBS Project The signer's email address is opensuse:maintenance@build.opensuse.org Signing time: Wed Apr 03, 2013 There were certs or crls included. --------------------------------------------- Is it possible to query/see certificate using osc/OBS API? osc --signkey apparently returns something different (RPM signature key?) We checked this in after we fixed the signing keys in openSUSE:Maintenance:* I hoped. Apparently something is still amiss. No you didn't. The packages were built Apr 3rd, I fixed the cert Apr 4th. oh. can you check if the signing in openSUSE:Maintenance:1577 http://download.opensuse.org/repositories/openSUSE:/Maintenance:/1577/openSUSE_12.3_Update_standard/ is ok? It's ok per the pesign output. And I did a quick test on it without problem (WORKS_FOR_ME). --------------------------------------------- Content was not encrypted. Content is detached; signature cannot be verified. The signer's common name is openSUSE Secure Boot Signkey The signer's email address is build@opensuse.org Signing time: Thu Apr 11, 2013 There were certs or crls included. --------------------------------------------- Thanks. Anyone here can help to confirm that the issue can be closed or not? Thanks. we got a grub2 update tested (not yet released) with secure boot, so i think its good now. |