Module is not signed with expected PKCS#7 message

English Open Build Service (OBS)
1

Hello everyone!

I have the strange problem with building kernel in OBS.
Originally, it builds without any problem but only if I didn’t enable debug symbols.
If I did that it builds too but a server hasn’t loaded and written a message from the topic:

Module is not signed with expected PKCS#7 message

Probably someone knows why it happens?

2

In the bios:-

Is secure boot enabled?

Are there old secure keys listed?

3

It happens on different servers. I’m not sure is it depends on computer or BIOS.
The kernel, as well as many other packages, are builds in OBS. Also, any previous version of the kernel was build in OBS and works without any problem.
I found a strange thread about this, tried, but it didn’t help me. Maybe someone knows how to investigate this problem or fix it?
Oh, below link to the founded thread:
https://build.opensuse.org/request/show/530628

4

link to your package would be more useful

5

Unfortunately I can’t because my OBS server is private. But I’ve found the problem:


   67s] ~/rpmbuild/BUILD/pesign-repackage-1.0
   67s] + for log in '/home/abuild/rpmbuild/SOURCES/*.log'
   67s] + test -e /home/abuild/rpmbuild/SOURCES/make-stderr.log
   67s] + mkdir -p /home/abuild/rpmbuild/OTHER
   67s] + cp /home/abuild/rpmbuild/SOURCES/make-stderr.log /home/abuild/rpmbuild/OTHER
   67s] + for log in '/home/abuild/rpmbuild/SOURCES/*.log'
   67s] + test -e /home/abuild/rpmbuild/SOURCES/rpmlint.log
   67s] + mkdir -p /home/abuild/rpmbuild/OTHER
   67s] + cp /home/abuild/rpmbuild/SOURCES/rpmlint.log /home/abuild/rpmbuild/OTHER
   67s] + mkdir rsasigned
   67s] + pushd rsasigned
   67s] ~/rpmbuild/BUILD/pesign-repackage-1.0/rsasigned ~/rpmbuild/BUILD/pesign-repackage-1.0
   67s] + cpio -idm
   67s] 3467 blocks
   67s] + cat
   67s] ++ wc -l
   67s] + test 0 -le 1 -a -s /home/abuild/rpmbuild/SOURCES/_projectcert.crt
   67s] ++ wc -l
   67s] + test 0 -gt 1
   67s] + echo 'warning: No buildservice project certificate found, add'
   67s] warning: No buildservice project certificate found, add
   67s] + echo 'warning: # needssslcertforbuild to the specfile'
   67s] warning: # needssslcertforbuild to the specfile
   67s] + echo 'warning: Using /usr/lib/rpm/pesign/pesign-cert.x509 as fallback'
   67s] warning: Using /usr/lib/rpm/pesign/pesign-cert.x509 as fallback
   67s] + cert=/usr/lib/rpm/pesign/pesign-cert.x509
   67s] + mkdir nss-db
   67s] + nss_db=/home/abuild/rpmbuild/BUILD/pesign-repackage-1.0/rsasigned/nss-db
   67s] + echo foofoofoo
   67s] + certutil -N -d /home/abuild/rpmbuild/BUILD/pesign-repackage-1.0/rsasigned/nss-db -f /home/abuild/rpmbuild/BUILD/pesign-repackage-1.0/rsasigned/nss-db/passwd
   67s] + certutil -A -d /home/abuild/rpmbuild/BUILD/pesign-repackage-1.0/rsasigned/nss-db -f /home/abuild/rpmbuild/BUILD/pesign-repackage-1.0/rsasigned/nss-db/passwd -n cert -t CT,CT,CT -i /usr/lib/rpm/pesign/pesign-cert.x509
   67s] certutil:  unable to open "/usr/lib/rpm/pesign/pesign-cert.x509" for reading (-5950, 2).
   67s] error: Bad exit status from /var/tmp/rpm-tmp.Rx8q4f (%install)

Probably someone knows where can I find _projectcert.crt?

6

It is created automatically by OBS from project key. Use “osc signkey --create” to create one.