How to enable SHA256 or HMAC verification for vmlinuz/initrd in KIWI NG with Dracut 10?
0
votes
0
answers
20
views
I'm migrating a custom Linux image setup from KIWI NG 10 + Dracut 9 to KIWI NG 10 + Dracut 10 on RHEL 9, and I’m encountering issues related to kernel/initrd verification during boot.
🧩 Previous Setup (KIWI NG 10 + Dracut 9):
Checksums (*.sha256) for vmlinuz and initrd were automatically verified during boot.
I did not explicitly configure any checksum generation or verification in config.sh, images.sh.
Boot worked reliably with implicit SHA256-based verification behavior.
🚧 Problem in New Setup (KIWI NG 10 + Dracut 10):
After upgrading to Dracut 10, I observe that:
SHA256 checks are not automatically performed.
If I manually generate /run/image/*.sha256, they are ignored during boot.
I also attempted to rely on pre-generated .vmlinuz.hmac (available on RHEL 9 systems), but Dracut does not seem to use it.
I cannot find any logic in dracut-kiwi-lib or core dracut that verifies kernel/initrd hashes out of the box.
The image boots and throw information about missing /run/image/*.sha256. After that vm just shutdown.
Any help would be appreciate :)
Asked by Viktor Nareiko
(1 rep)
Jul 8, 2025, 01:36 PM