Set kpatch/driver certs for all builds

[skip77]

• Kpatch and driver (DUP) certs should be embedded in all builds - official and local (unsigned)
• No version increment here - this change doesn't affect any releases, only local builds

[Copilot]

Pull request overview

This PR updates the kernel spec so DUP (driver) and kpatch signing certificates are embedded more broadly across builds, aiming to make local (previously unsigned) builds include the same trusted cert material as official builds.

Changes:

• Removes the pe_signing_certkeyslot gating so CIQ/driver/kpatch cert handling is no longer limited to a specific signing setup.
• Adjusts the trusted-keys injection flow to prefer CIQ’s combined ciqkernel.pem in more cases.
• Updates the spec logic around how trusted key PEMs are selected during config generation.

Suppressed comments (3)

ciq/SPECS/kernel-clk6.18.spec:1009

• secureboot_ca_0 is now overridden to the CIQ CA for all arches in the RHEL(!eln) signing block, but pesign_name_0 / secureboot_key_0 are only overridden for x86_64 and aarch64. On other arches (e.g. s390x/ppc64le) this produces a mixed CA+key configuration, which can break %pesign invocations that use both macros. Limit the CIQ CA override to the same arch blocks where the corresponding signing cert/key is also overridden (or provide CIQ equivalents for the remaining arches).

This issue also appears in the following locations of the same file:

• line 2183
• line 2204

# CIQ Kernel will override above with CIQ certs
%define secureboot_ca_0 %{SOURCE8001}
%ifarch x86_64
%define pesign_name_0 ciq_sb_kernel
%define secureboot_key_0 %{SOURCE8002}

ciq/SPECS/kernel-clk6.18.spec:2187

• This block now always tries to build certs/ciqkernel.pem from %{driver_cert} / %{kpatch_cert} on RHEL builds. Those macros are only defined on x86_64/aarch64 earlier in the spec, so other arches (and any build without those macros) will fail during openssl x509 -in %{driver_cert} expansion. Consider restoring a fallback path when the CIQ cert macros aren’t defined (e.g. use the existing %{rhelkeys} + Source100/101/102 flow).

# Add DUP and kpatch certificates to system trusted keys for Rocky Linux from CIQ
%{log_msg "Add DUP and kpatch certificates to system trusted keys for Rocky Linux from CIQ"}
openssl x509 -inform der -in %{driver_cert} -out ciqkerneldup1.pem
openssl x509 -inform der -in %{kpatch_cert} -out ciqkernelkpatch1.pem
openssl x509 -inform der -in %{SOURCE102} -out nvidiagpuoot001.pem

ciq/SPECS/kernel-clk6.18.spec:2206

• CONFIG_SYSTEM_TRUSTED_KEYS is now always set to certs/ciqkernel.pem, but ciqkernel.pem is only generated inside the %if 0%{?rhel} block above. This will break non-RHEL builds (and any RHEL build that takes the fallback path) because the referenced PEM won’t exist / won’t be populated. Make the sed target conditional so it points at ciqkernel.pem only when that file is produced; otherwise fall back to certs/rhel.pem.

for i in *.config; do
  sed -i 's@CONFIG_SYSTEM_TRUSTED_KEYS=""@CONFIG_SYSTEM_TRUSTED_KEYS="certs/ciqkernel.pem"@' $i
  sed -i 's@CONFIG_EFI_SBAT_FILE=""@CONFIG_EFI_SBAT_FILE="kernel.sbat"@' $i

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bmastbergen]

🥌 LGTM can we make the same change in ciq-6.12.y ?

[PlaidCat]