lkml.org 
[lkml]   [2015]   [Feb]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH] X.509: Fix certificate gathering again
On Fri, Feb 20, 2015 at 02:52:14PM +0100, Michal Marek wrote:
> On 2015-02-19 13:26, David Howells wrote:
> > Michal Marek <mmarek@suse.cz> wrote:
> >
> >> +X509_CERTIFICATES-y := $(wildcard *.x509)
> >> +ifneq ($(objtree),$(srctree))
> >> +X509_CERTIFICATES-y += $(wildcard $(srctree)/*.x509)
> >> +endif
> >> +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509
> >> +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y))
> >
> > What will happen if there's a "signing_key.x509" in the source tree when O= is
> > used?
>
> It will fail. So the patch needs more work, thanks for the review.

OK, this works for me and I finally understand why :). The problem is
that whatever file make sees (as a target or dependency) first, it will
prefer it for the purpose of VPATH search, so the right signing_key.x509
must come first. Unfortunately, using 'vpath %.x509' does not do the
trick, because this merely says not to use any special VPATH for files
matching this pattern, but it does not avoid the global VPATH.

From 1774298ef0fa770cd7e8810ed57ceb4e8a7c5def Mon Sep 17 00:00:00 2001
From: Michal Marek <mmarek@suse.cz>
Date: Wed, 8 Oct 2014 13:15:28 +0200
Subject: [PATCH] X.509: Fix certificate gathering again

Commit d7ec435f (X.509: Fix certificate gathering) fixed the issue of
changing .x509.list, but in the CONFIG_MODULE_SIG=y case, it assumed
that $(objtree) was an absolute path. Commit 7e1c0477 (kbuild: Use
relative path for $(objtree)) broke this assumption and we get
uncecessary rebuilds again, due to ./signing_key.x509 changing to
signing_key.x509. Instead of prepending the absolute path and
stripping it again, just check if $(srctree) and $(objtree) are
different directories and add $(srctree)/*.x509 only in such case.

However, such fix causes a different issue, namely that a potential
$(srctree)/signing_key.x509 appears before the to-be-generated
signing_key.x509 in the sorted list, and make remembers this file for
the purpose of VPATH search. It worked previously, because
./signing_key.x509 sorts before any absolute path. Solve this by sorting
the $(objtree) and $(srctree) files separately, to ensure that
signing_key.x509 appears before anything from $(srctree).

Signed-off-by: Michal Marek <mmarek@suse.cz>
---
kernel/Makefile | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/kernel/Makefile b/kernel/Makefile
index 1408b33..792e043 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -117,17 +117,18 @@ $(obj)/config_data.h: $(obj)/config_data.gz FORCE
# boot.
#
# We look in the source root and the build root for all files whose name ends
-# in ".x509". Unfortunately, this will generate duplicate filenames, so we
-# have make canonicalise the pathnames and then sort them to discard the
-# duplicates.
+# in ".x509". We put the $(objtree) certificates before those from $(srctree),
+# so that a potential signing_key.x509 file from $(srctree) does not take
+# precedence.
#
###############################################################################
ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
-X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509)
-X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509
-X509_CERTIFICATES-raw := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \
- $(or $(realpath $(CERT)),$(CERT))))
-X509_CERTIFICATES := $(subst $(realpath $(objtree))/,,$(X509_CERTIFICATES-raw))
+X509_CERTIFICATES-y := $(wildcard *.x509)
+X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509
+X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y))
+ifneq ($(objtree),$(srctree))
+X509_CERTIFICATES += $(sort $(wildcard $(srctree)/*.x509))
+endif

ifeq ($(X509_CERTIFICATES),)
$(warning *** No X.509 certificates found ***)
--
1.9.2


\
 
 \ /
  Last update: 2015-02-20 23:21    [W:0.060 / U:0.772 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site