Thorsten Leemhuis 7c2f874c63 module: sign with sha512 instead of sha1 by default ... commit f3b93547b91ad849b58eb5ab2dd070950ad7beb3 upstream. Switch away from using sha1 for module signing by default and use the more modern sha512 instead, which is what among others Arch, Fedora, RHEL, and Ubuntu are currently using for their kernels. Sha1 has not been considered secure against well-funded opponents since 2005[1]; since 2011 the NIST and other organizations furthermore recommended its replacement[2]. This is why OpenSSL on RHEL9, Fedora Linux 41+[3], and likely some other current and future distributions reject the creation of sha1 signatures, which leads to a build error of allmodconfig configurations: 80A20474797F0000:error:03000098:digital envelope routines:do_sigver_init:invalid digest:crypto/evp/m_sigver.c:342: make[4]: *** [.../certs/Makefile:53: certs/signing_key.pem] Error 1 make[4]: *** Deleting file 'certs/signing_key.pem' make[4]: *** Waiting for unfinished jobs.... make[3]: *** [.../scripts/Makefile.build:478: certs] Error 2 make[2]: *** [.../Makefile:1936: .] Error 2 make[1]: *** [.../Makefile:224: __sub-make] Error 2 make[1]: Leaving directory '...' make: *** [Makefile:224: __sub-make] Error 2 This change makes allmodconfig work again and sets a default that is more appropriate for current and future users, too. Link: https://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html [1] Link: https://csrc.nist.gov/projects/hash-functions [2] Link: https://fedoraproject.org/wiki/Changes/OpenSSLDistrustsha1SigVer [3] Signed-off-by: Thorsten Leemhuis <linux@leemhuis.info> Reviewed-by: Sami Tolvanen <samitolvanen@google.com> Tested-by: kdevops <kdevops@lists.linux.dev> [0] Link: https://github.com/linux-kdevops/linux-modules-kpd/actions/runs/11420092929/job/31775404330 [0] Link: https://lore.kernel.org/r/52ee32c0c92afc4d3263cea1f8a1cdc809728aff.1729088288.git.linux@leemhuis.info Signed-off-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-05-02 07:46:49 +02:00
..
debug_kmemleak.c
decompress.c	module/decompress: use vmalloc() for gzip decompression workspace	2023-11-20 11:52:03 +01:00
internal.h	dyndbg: gather __dyndbg[] state into struct _ddebug_info	2022-09-07 17:04:48 +02:00
kallsyms.c	kallsyms: Make module_kallsyms_on_each_symbol generally available	2024-01-05 15:18:40 +01:00
Kconfig	module: sign with sha512 instead of sha1 by default	2025-05-02 07:46:49 +02:00
kdb.c
livepatch.c
main.c	modules: wait do_free_init correctly	2024-03-26 18:20:52 -04:00
Makefile	module: Fix KCOV-ignored file name	2024-10-17 15:21:27 +02:00
procfs.c	module: Modify module_flags() to accept show_state argument	2022-07-14 17:40:23 -07:00
signing.c
strict_rwx.c
sysfs.c
tracking.c	module: tracking: Keep a record of tainted unloaded modules only	2022-10-10 12:16:19 -07:00
tree_lookup.c
version.c