Skip to content

initrd/bin/kexec-sign-config.sh: stop re-hashing stale default entry paths on -u update #2150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tlaurion wants to merge 1 commit into
base: master
Choose a base branch
from
+12 −6
Open

initrd/bin/kexec-sign-config.sh: stop re-hashing stale default entry paths on -u update #2150

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions initrd/bin/kexec-sign-config.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,12 +55,18 @@ if [ "$update" = "y" ]; then
DEBUG "update=y: Updating kexec hashes in staging dir $stagedir"
cd /boot
find ./ -type f ! -path './kexec*' -print0 | xargs -0 sha256sum >"$stagedir/kexec_hashes.txt"
if [ -e /boot/kexec_default_hashes.txt ]; then
DEBUG "/boot/kexec_default_hashes.txt exists, updating in staging"
DEFAULT_FILES=$(cut -f3 -d ' ' </boot/kexec_default_hashes.txt)
echo "$DEFAULT_FILES" | xargs sha256sum >"$stagedir/kexec_default_hashes.txt"
fi

# kexec_default_hashes.txt is intentionally NOT re-hashed here.
# The re-hash extracts file paths from the old default hash file
# and runs sha256sum on each. Qubes OS does NOT fan out old and
# new xen binaries: a dom0 update atomically deletes the old
# binary while providing the new one (xen-4.19.4.gz replaced by
# xen-4.19.5.gz in-place — QubesOS/qubes-vmm-xen#220 shipped to
# stable via QubesOS/updates-status#6746 on 2026-07-02). The old
# path no longer exists on disk, sha256sum fails, and DIE is
# called inside this -u subshell before the -r (rollback counter)
# block below can ever run (coupled since commit 8bfae52ad6a).
# The user re-saves a default from the boot menu to regenerate
# kexec_default_hashes.txt with current paths.
#also save the file & directory structure to detect added files
print_tree >"$stagedir/kexec_tree.txt"
)
Expand Down