linux-surface/pkg/fedora/kernel-surface/secureboot/0001-secureboot.patch

From 71133b4337411ddd550d5e5ef68a12c510740b2c Mon Sep 17 00:00:00 2001
From: Dorian Stoll <dorian.stoll@tmsp.io>
Date: Sat, 22 Jul 2023 10:45:33 +0200
Subject: [PATCH] Use a custom key and certificate for Secure Boot signing

Signed-off-by: Dorian Stoll <dorian.stoll@tmsp.io>
---
 redhat/kernel.spec.template | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index 28df94e561d4..fd44abc4118a 100644
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -805,6 +805,7 @@ BuildRequires: system-sb-certs
 %ifarch x86_64 aarch64
 BuildRequires: nss-tools
 BuildRequires: pesign >= 0.10-4
+BuildRequires: sbsigntools
 %endif
 %endif
 %endif
@@ -864,6 +865,13 @@ Source1: Makefile.rhelver
 %define signing_key_filename kernel-signing-s390.cer
 %endif
 
+%ifarch x86_64 aarch64
+
+Source7001: MOK.key
+Source7002: MOK.crt
+
+%endif
+
 %if %{?released_kernel}
 
 Source10: redhatsecurebootca5.cer
@@ -2096,9 +2104,7 @@ BuildKernel() {
     SignImage=$KernelImage
 
     %ifarch x86_64 aarch64
-    %pesign -s -i $SignImage -o vmlinuz.tmp -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0}
-    %pesign -s -i vmlinuz.tmp -o vmlinuz.signed -a %{secureboot_ca_1} -c %{secureboot_key_1} -n %{pesign_name_1}
-    rm vmlinuz.tmp
+    sbsign --key %{SOURCE7001} --cert %{SOURCE7002} --output vmlinuz.signed $SignImage
     %endif
     %ifarch s390x ppc64le
     if [ -x /usr/bin/rpm-sign ]; then
@@ -2650,9 +2656,6 @@ BuildKernel() {
     # Red Hat UEFI Secure Boot CA cert, which can be used to authenticate the kernel
     mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer
     %ifarch x86_64 aarch64
-       install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20200609.cer
-       install -m 0644 %{secureboot_ca_1} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20140212.cer
-       ln -s kernel-signing-ca-20200609.cer $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
     %else
        install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
     %endif
-- 
2.41.0