Re: [PATCH 7/8] kbuild: support 'make modules_sign' with CONFIG_MODULE_SIG_ALL=n

[Nicolas Schier]

On Wed 23 Aug 2023 20:50:47 GMT, Masahiro Yamada wrote:
> Commit d890f510c8e4 ("MODSIGN: Add modules_sign make target") introduced
> 'make modules_sign' to manually sign modules.
> 
> Some time later, commit d9d8d7ed498e ("MODSIGN: Add option to not sign
> modules during modules_install") introduced CONFIG_MODULE_SIG_ALL.
> If it was disabled, mod_sign_cmd was set to no-op ('true' command).
> It affected not only 'make modules_install' but also 'make modules_sign'.
> With CONFIG_MODULE_SIG_ALL=n, 'make modules_install' did not sign modules
> and 'make modules_sign' could not sign modules either.
> 
> Kbuild has kept that behavior, and nobody has complained about it, but
> I think it is weird.
> 
> CONFIG_MODULE_SIG_ALL=n should turn off signing only for modules_install.
> If users want to sign modules manually, they should be allowed to use
> 'make modules_sign'.
> 
> Signed-off-by: Masahiro Yamada <masahiroy@xxxxxxxxxx>
> ---

Reviewed-by: Nicolas Schier <nicolas@xxxxxxxxx>

> 
>  scripts/Makefile.modinst | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst
> index dc7c54669082..33d424a3f265 100644
> --- a/scripts/Makefile.modinst
> +++ b/scripts/Makefile.modinst
> @@ -106,7 +106,6 @@ endif
>  # Signing
>  # Don't stop modules_install even if we can't sign external modules.
>  #
> -ifeq ($(CONFIG_MODULE_SIG_ALL),y)
>  ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),)
>  sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY)
>  else
> @@ -115,13 +114,15 @@ endif
>  quiet_cmd_sign = SIGN    $@
>        cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \
>                   $(if $(KBUILD_EXTMOD),|| true)
> -else
> +
> +ifeq ($(modules_sign_only),)
> +
> +# During modules_install, modules are signed only when CONFIG_MODULE_SIG_ALL=y.
> +ifndef CONFIG_MODULE_SIG_ALL
>  quiet_cmd_sign :=
>        cmd_sign := :
>  endif
>  
> -ifeq ($(modules_sign_only),)
> -
>  $(dst)/%.ko: $(extmod_prefix)%.ko FORCE
>  	$(call cmd,install)
>  	$(call cmd,strip)
> -- 
> 2.39.2

-- 
Nicolas Schier
 
epost|xmpp: nicolas@xxxxxxxxx          irc://oftc.net/nsc
↳ gpg: 18ed 52db e34f 860e e9fb  c82b 7d97 0932 55a0 ce7f
     -- frykten for herren er opphav til kunnskap --

Attachment: signature.asc
Description: PGP signature