Sample Header Ad - 728x90

How to enable SHA256 or HMAC verification for vmlinuz/initrd in KIWI NG with Dracut 10?

0 votes
0 answers
20 views
I'm migrating a custom Linux image setup from KIWI NG 10 + Dracut 9 to KIWI NG 10 + Dracut 10 on RHEL 9, and I’m encountering issues related to kernel/initrd verification during boot. 🧩 Previous Setup (KIWI NG 10 + Dracut 9): Checksums (*.sha256) for vmlinuz and initrd were automatically verified during boot. I did not explicitly configure any checksum generation or verification in config.sh, images.sh. Boot worked reliably with implicit SHA256-based verification behavior. 🚧 Problem in New Setup (KIWI NG 10 + Dracut 10): After upgrading to Dracut 10, I observe that: SHA256 checks are not automatically performed. If I manually generate /run/image/*.sha256, they are ignored during boot. I also attempted to rely on pre-generated .vmlinuz.hmac (available on RHEL 9 systems), but Dracut does not seem to use it. I cannot find any logic in dracut-kiwi-lib or core dracut that verifies kernel/initrd hashes out of the box. The image boots and throw information about missing /run/image/*.sha256. After that vm just shutdown. Any help would be appreciate :)
Asked by Viktor Nareiko (1 rep)
Jul 8, 2025, 01:36 PM