Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Mickaël Salaün]

On 13/06/2022 20:56, Masahiro Yamada wrote:
> On Tue, Jun 14, 2022 at 3:06 AM Mickaël Salaün <mic@xxxxxxxxxxx> wrote:
> > On 13/06/2022 16:55, Masahiro Yamada wrote:
> > > On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <mic@xxxxxxxxxxx> wrote:
> > > > On 11/06/2022 19:22, Masahiro Yamada wrote:
> > > > > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > > > > valid") was applied 8 months after the submission.
> > > > >
> > > > > In the meantime, the base code had been removed by commit b8c96a6b466c
> > > > > ("certs: simplify $(srctree)/ handling and remove config_filename
> > > > > macro").
> > > > >
> > > > > Fix the Makefile.
> > > > >
> > > > > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > > > > included from certs/blacklist_hashes.c and also works as a timestamp.
> > > > >
> > > > > Send error messages from check-blacklist-hashes.awk to stderr instead
> > > > > of stdout.
> > > > >
> > > > > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > > > > Signed-off-by: Masahiro Yamada <masahiroy@xxxxxxxxxx>
> > > >
> > > > Reviewed-by: Mickaël Salaün <mic@xxxxxxxxxxxxxxxxxxx>
> > > >
> > > > As a side note, it may let an orphan certs/blacklist_hashes_checked file
> > > > but we can't really do something about that and it's OK.
> > >
> > >
> > > GNU Make uses timestamps of files for dependency tracking,
> > > so Kbuild keeps all intermediate files.
> > >
> > > Keeping certs/blacklist_hashes_checked
> > > is the right thing to do.
> >
> > blacklist_hashes_checked is the file you replaced with
> > blacklist_hash_list, and is then not used in any Makefile anymore. There
> > is then no timestamp issue. I just wanted to mention that it is normal
> > that a git status will show it on build directories also used as source
> > directories that were already using such feature.
>
>
> Ah, sorry, I misunderstood your feedback.
>
> If 'git status' is your concern,
> we can add certs/blacklist_hashes_checked
> to scripts/remove-stale-files.
>
> addf466389d9d78f255e8b15ac44ab4791029852
> was merged into mainline just recently, and
> not contained in any release.

Indeed, it's all good then.

> But, if the orphan timestamp matters, I will do it.
> It is just a one-liner addition.