Kernel Compilation Issue on Ubuntu 24.04: Missing Rule for 'debian/canonical-certs.pem'

[Daniel-TI-LINUX]

[RESOLVED] I'm having a problem trying to compile any version of the kernel on my Ubuntu 24.04. I'm getting the following error:

root@lab-A78F2P-M-V2-0:/usr/src/linux-6.12-rc4# make
  CALL    scripts/checksyscalls.sh
  DESCEND objtool
  INSTALL libsubcmd_headers
make[3]: *** No rule to make target 'debian/canonical-certs.pem', needed by 'certs/x509_certificate_list'.  Stop.
make[2]: *** [scripts/Makefile.build:478: certs] Error 2
make[1]: *** [/usr/src/linux-6.12-rc4/Makefile:1936: .] Error 2
make: *** [Makefile:224: __sub-make] Error 2
root@lab-A78F2P-M-V2-0:/usr/src/linux-6.12-rc4#

---

Does anyone know how I can resolve this? The error occurs both when trying to compile the kernel and the modules.

 

[osprey]

I'm having a problem trying to compile any version of the kernel on my Ubuntu 24.04. I'm getting the following error:

root@lab-A78F2P-M-V2-0:/usr/src/linux-6.12-rc4# make
  CALL    scripts/checksyscalls.sh
  DESCEND objtool
  INSTALL libsubcmd_headers
make[3]: *** No rule to make target 'debian/canonical-certs.pem', needed by 'certs/x509_certificate_list'.  Stop.
make[2]: *** [scripts/Makefile.build:478: certs] Error 2
make[1]: *** [/usr/src/linux-6.12-rc4/Makefile:1936: .] Error 2
make: *** [Makefile:224: __sub-make] Error 2
root@lab-A78F2P-M-V2-0:/usr/src/linux-6.12-rc4#

---

Does anyone know how I can resolve this? The error occurs both when trying to compile the kernel and the modules.

Perhaps check your kernel configurations, for example the config like:
CONFIG_SYSTEM_TRUSTED_KEYS=
and relevant others.

See here for a similar issue:

Compiling kernel gives error No rule to make target 'debian/certs/debian-uefi-certs.pem'

Compiling kernel gives error No rule to make target 'debian/certs/debian-uefi-certs.pem I am following this tutorial https://www.cyberciti.biz/tips/compiling-linux-kernel-26.html CC kernel/

stackoverflow.com

There's a few options there to try.

There's also the question of why one would use root for the compiling process. Perhaps worth considering Linus' comments in the kernel docs:

To do the actual install, you have to be root, but none of the normal
build should require that. Don't take the name of root in vain.

 

[Daniel-TI-LINUX]

Even doing what is on this site (commenting out the lines 'CONFIG_SYSTEM_TRUSTED_KEYS' and 'CONFIG_MODULES_KEYS' when running make), it seems to reconfigure and asks to regenerate the files:

SYNC include/config/auto.conf.cmd*

• Restart config...
• 
  
• 
  
• Certificates for signature checking

File name or PKCS#11 URI of module signing key (MODULE_SIG_KEY) [certs/signing_key.pem] (NEW)

When it generates, it gives the same error.

 

[Daniel-TI-LINUX]

Hi everyone, I found a way to resolve an issue during the kernel compilation. I removed the CONFIG_SYSTEM_TRUSTED setting and also removed the module options (CONFIG_MODULES).

During the compilation, I received the following message:


SYNC include/config/auto.conf.cmd

• Restart config...
• Certificates for signature checking
• File name or PKCS#11 URI of module signing key (MODULE_SIG_KEY) [certs/signing_key.pem] (NEW)
• Type of module signing key to be generated

1. RSA (MODULE_SIG_KEY_TYPE_RSA) (NEW)
2. ECDSA (MODULE_SIG_KEY_TYPE_ECDSA) (NEW)

choice[1-2?]: 2
* Provide system-wide ring of trusted keys (SYSTEM_TRUSTED_KEYRING) [Y/?] (NEW) y
...

I selected ECDSA as the type of module key. After these changes, I was able to compile without errors. I hope this helps anyone experiencing the same issue!