wiki.matoken.org

snippet.bash

$ sudo apt install build-essential flex bison fakeroot gpg2
$ sudo apt build-dep linux

snippet.bash

$ wget https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.13.tar.xz https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.13.tar.sign
$ unxz ./linux-5.13.tar.xz
$ gpg --verify ./linux-5.13.tar.sign
$ tar xf ./linux-5.13.tar
$ cd linux-5.13

署名はこのあたりを

• The Linux Kernel Archives \- Signatures

snippet.bash

$ cp /boot/config-`uname -r` ./.config
$ make olddefconfig
$ make xconfig
$ make testconfig
$ grep ^CONFIG_SYSTEM_TRUSTED_KEYS= ./.config
CONFIG_SYSTEM_TRUSTED_KEYS=""

snippet.bash

$ time make -j`nproc` bindeb-pkg

ローカルバージョンのプレフィックスを付けたい場合は， LOCALVERSION を指定する

snippet.bash

$ time make -j`nproc` bindeb-pkg LOCALVERSION=-mptcp
  :
real    67m55.491s                                                                                                                                   
user    224m59.652s                                                                                                                                  
sys     20m35.241s 
$ ls ../linux-*5.13.0-mptcp*.deb
../linux-headers-5.13.0-mptcp_5.13.0-mptcp-1_amd64.deb  ../linux-libc-dev_5.13.0-mptcp-1_amd64.deb
../linux-image-5.13.0-mptcp_5.13.0-mptcp-1_amd64.deb

snippet.bash

$ sudo apt install ../linux-image-5.13.0-mptcp_5.13.0-mptcp-1_amd64.deb ../linux-headers-5.13.0-mptcp_5.13.0-mptcp-1_amd64.deb ../linux-libc-dev_5.13.0-mptcp-1_amd64.deb

SecureBoot環境の場合再起動前にMOKで署名しておく．

kernelに署名

snippet.bash

$ sudo sbsign --key ~root/MOK.priv --cert ~root/MOK.pem /boot/vmlinuz-5.13.0-mptcp --output ./vmlinuz-5.13.0-mptcp
$ sudo mv ./vmlinuz-5.13.0-mptcp /boot/vmlinuz-5.13.0-mptcp

(あれば)dkms moduleにも署名

snippet.bash

$ find /lib/modules/5.13.0-mptcp/updates/dkms/ -type f -print0 | xargs -0 -n1 sudo /usr/lib/linux-kbuild-5.10/scripts/sign-file sha256 ~root/MOK.priv ~root/MOK.der

再起動で反映

linux-5.12