Speaker
Description
The kernels current module signature scheme does not work well together with reproducible builds. If the key is generated at build-time the build is not reproducible. A static key that is known to the public does not provide security, but a static key not known to the public does prevent public rebuilds of the kernel for validation purposes.
Currently distributions need to make a tradeoff:
* Allow non-public reproducibility through static module signature keys. At the cost of complexity in build infrastructure and package definitions. (Debian)
* Focus on reproducibility and disable module signatures (NixOS)
* Focus on security and have an irreproducible kernel package (ArchLinux)
I am proposing the replacement of module signatures for built-in modules with a merkle tree calculated at build-time.
This solves the problems outlined above and also avoids a lot of the complexity involved in the current implementation.
Agenda:
* Problem statement
* Current proposal
* Discussion
Discussion topics:
* How to strip modules as part of this scheme?
* Problems in the integration with kbuild.
* How to interact with IMA?
* Would it make sense to have a generic and reusable merkle tree implementation?
Current series on LKML: https://lore.kernel.org/lkml/20260505-module-hashes-v5-0-e174a5a49fce@weissschuh.net/
LWN article for the previous implementation: https://lwn.net/Articles/1012946/