diff --git a/README.md b/README.md index 6161c70a..3711a414 100644 --- a/README.md +++ b/README.md @@ -81,16 +81,20 @@ rpm-ostree kargs \ 3. Enable Secure Boot support +IMPORTANT NOTE: On June 17, 00:00 UTC, we will make a change to the key which is used to sign nvidia kernel modules. The new key is being made available May 17. The new key is `akmods-ublue.der` / `public_key.der.new` in the code blocks below. Until this document is updated to remove the old key, please import BOTH keys! This will ensure your SecureBoot system boots as expected after the cutover on June 17. + [Secure Boot](https://rpmfusion.org/Howto/Secure%20Boot) support for the nvidia kernel modules can be enabled by enrolling the signing key: ``` sudo mokutil --import /etc/pki/akmods/certs/akmods-nvidia.der +sudo mokutil --import /etc/pki/akmods/certs/akmods-ublue.der ``` Alternatively, the key can be enrolled from within this repo: ``` sudo mokutil --import ./certs/public_key.der +sudo mokutil --import ./certs/public_key.der.new ``` ## Rolling back and rebasing diff --git a/build.sh b/build.sh index 2edb38d3..71616fe3 100755 --- a/build.sh +++ b/build.sh @@ -45,6 +45,8 @@ modinfo /usr/lib/modules/${KERNEL_VERSION}/extra/${NVIDIA_PACKAGE_NAME}/nvidia{, sed -i "s@gpgcheck=0@gpgcheck=1@" /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/nvidia-container-runtime.repo install -D /etc/pki/akmods/certs/public_key.der /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/public_key.der +# copy new public key to facilitate user imports before switching +install -Dm644 /tmp/certs/public_key.der.new /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/public_key.der.new rpmbuild -ba \ --define '_topdir /tmp/ublue-os-nvidia-addons/rpmbuild' \ diff --git a/certs/public_key.der.new b/certs/public_key.der.new new file mode 100755 index 00000000..a2ee4477 Binary files /dev/null and b/certs/public_key.der.new differ diff --git a/ublue-os-nvidia-addons.spec b/ublue-os-nvidia-addons.spec index f4035b1b..d6b0aaa9 100644 --- a/ublue-os-nvidia-addons.spec +++ b/ublue-os-nvidia-addons.spec @@ -1,5 +1,5 @@ Name: ublue-os-nvidia-addons -Version: 0.4 +Version: 0.5 Release: 1%{?dist} Summary: Additional files for nvidia driver support @@ -15,6 +15,7 @@ Source2: lukenukem-asus-linux.repo Source3: config-rootless.toml Source4: nvidia-container.pp Source5: environment +Source6: public_key.der.new %description Adds various runtime files for nvidia support. These include a key for importing with mokutil to enable secure boot for nvidia kernel modules @@ -31,10 +32,12 @@ install -Dm0644 %{SOURCE2} %{buildroot}%{_datadir}/ublue-os/%{_sysconfdir}/yum.r install -Dm0644 %{SOURCE3} %{buildroot}%{_datadir}/ublue-os/%{_sysconfdir}/nvidia-container-runtime/config-rootless.toml install -Dm0644 %{SOURCE4} %{buildroot}%{_datadir}/ublue-os/%{_datadir}/selinux/packages/nvidia-container.pp install -Dm0644 %{SOURCE5} %{buildroot}%{_datadir}/ublue-os/%{_sysconfdir}/sway/environment +install -Dm0644 %{SOURCE6} %{buildroot}%{_datadir}/ublue-os/%{_sysconfdir}/pki/akmods/certs/akmods-ublue.der sed -i 's@enabled=1@enabled=0@g' %{buildroot}%{_datadir}/ublue-os/%{_sysconfdir}/yum.repos.d/{lukenukem-asus-linux,nvidia-container-runtime}.repo install -Dm0644 %{buildroot}%{_datadir}/ublue-os/%{_sysconfdir}/pki/akmods/certs/akmods-nvidia.der %{buildroot}%{_sysconfdir}/pki/akmods/certs/akmods-nvidia.der +install -Dm0644 %{buildroot}%{_datadir}/ublue-os/%{_sysconfdir}/pki/akmods/certs/akmods-ublue.der %{buildroot}%{_sysconfdir}/pki/akmods/certs/akmods-ublue.der install -Dm0644 %{buildroot}%{_datadir}/ublue-os/%{_sysconfdir}/yum.repos.d/nvidia-container-runtime.repo %{buildroot}%{_sysconfdir}/yum.repos.d/nvidia-container-runtime.repo install -Dm0644 %{buildroot}%{_datadir}/ublue-os/%{_sysconfdir}/yum.repos.d/lukenukem-asus-linux.repo %{buildroot}%{_sysconfdir}/yum.repos.d/lukenukem-asus-linux.repo install -Dm0644 %{buildroot}%{_datadir}/ublue-os/%{_sysconfdir}/nvidia-container-runtime/config-rootless.toml %{buildroot}%{_sysconfdir}/nvidia-container-runtime/config-rootless.toml @@ -42,18 +45,23 @@ install -Dm0644 %{buildroot}%{_datadir}/ublue-os/%{_datadir}/selinux/packages/nv %files %attr(0644,root,root) %{_datadir}/ublue-os/%{_sysconfdir}/pki/akmods/certs/akmods-nvidia.der +%attr(0644,root,root) %{_datadir}/ublue-os/%{_sysconfdir}/pki/akmods/certs/akmods-ublue.der %attr(0644,root,root) %{_datadir}/ublue-os/%{_sysconfdir}/yum.repos.d/nvidia-container-runtime.repo %attr(0644,root,root) %{_datadir}/ublue-os/%{_sysconfdir}/yum.repos.d/lukenukem-asus-linux.repo %attr(0644,root,root) %{_datadir}/ublue-os/%{_sysconfdir}/nvidia-container-runtime/config-rootless.toml %attr(0644,root,root) %{_datadir}/ublue-os/%{_datadir}/selinux/packages/nvidia-container.pp %attr(0644,root,root) %{_datadir}/ublue-os/%{_sysconfdir}/sway/environment %attr(0644,root,root) %{_sysconfdir}/pki/akmods/certs/akmods-nvidia.der +%attr(0644,root,root) %{_sysconfdir}/pki/akmods/certs/akmods-ublue.der %attr(0644,root,root) %{_sysconfdir}/yum.repos.d/nvidia-container-runtime.repo %attr(0644,root,root) %{_sysconfdir}/yum.repos.d/lukenukem-asus-linux.repo %attr(0644,root,root) %{_sysconfdir}/nvidia-container-runtime/config-rootless.toml %attr(0644,root,root) %{_datadir}/selinux/packages/nvidia-container.pp %changelog +* Sun May 17 2023 Benjamin Sherman - 0.5 +- Add new ublue akmod public key for MOK enrollment + * Sun Mar 26 2023 Joshua Stone - 0.4 - Add asus-linux COPR