Messages in this thread Patch in this message | | | Date | Fri, 20 Feb 2015 23:10:12 +0100 | From | Michal Marek <> | Subject | Re: [PATCH] X.509: Fix certificate gathering again |
| |
On Fri, Feb 20, 2015 at 02:52:14PM +0100, Michal Marek wrote: > On 2015-02-19 13:26, David Howells wrote: > > Michal Marek <mmarek@suse.cz> wrote: > > > >> +X509_CERTIFICATES-y := $(wildcard *.x509) > >> +ifneq ($(objtree),$(srctree)) > >> +X509_CERTIFICATES-y += $(wildcard $(srctree)/*.x509) > >> +endif > >> +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 > >> +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) > > > > What will happen if there's a "signing_key.x509" in the source tree when O= is > > used? > > It will fail. So the patch needs more work, thanks for the review.
OK, this works for me and I finally understand why :). The problem is that whatever file make sees (as a target or dependency) first, it will prefer it for the purpose of VPATH search, so the right signing_key.x509 must come first. Unfortunately, using 'vpath %.x509' does not do the trick, because this merely says not to use any special VPATH for files matching this pattern, but it does not avoid the global VPATH.
From 1774298ef0fa770cd7e8810ed57ceb4e8a7c5def Mon Sep 17 00:00:00 2001 From: Michal Marek <mmarek@suse.cz> Date: Wed, 8 Oct 2014 13:15:28 +0200 Subject: [PATCH] X.509: Fix certificate gathering again
Commit d7ec435f (X.509: Fix certificate gathering) fixed the issue of changing .x509.list, but in the CONFIG_MODULE_SIG=y case, it assumed that $(objtree) was an absolute path. Commit 7e1c0477 (kbuild: Use relative path for $(objtree)) broke this assumption and we get uncecessary rebuilds again, due to ./signing_key.x509 changing to signing_key.x509. Instead of prepending the absolute path and stripping it again, just check if $(srctree) and $(objtree) are different directories and add $(srctree)/*.x509 only in such case.
However, such fix causes a different issue, namely that a potential $(srctree)/signing_key.x509 appears before the to-be-generated signing_key.x509 in the sorted list, and make remembers this file for the purpose of VPATH search. It worked previously, because ./signing_key.x509 sorts before any absolute path. Solve this by sorting the $(objtree) and $(srctree) files separately, to ensure that signing_key.x509 appears before anything from $(srctree).
Signed-off-by: Michal Marek <mmarek@suse.cz> --- kernel/Makefile | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/kernel/Makefile b/kernel/Makefile index 1408b33..792e043 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -117,17 +117,18 @@ $(obj)/config_data.h: $(obj)/config_data.gz FORCE # boot. # # We look in the source root and the build root for all files whose name ends -# in ".x509". Unfortunately, this will generate duplicate filenames, so we -# have make canonicalise the pathnames and then sort them to discard the -# duplicates. +# in ".x509". We put the $(objtree) certificates before those from $(srctree), +# so that a potential signing_key.x509 file from $(srctree) does not take +# precedence. # ############################################################################### ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) -X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509) -X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509 -X509_CERTIFICATES-raw := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \ - $(or $(realpath $(CERT)),$(CERT)))) -X509_CERTIFICATES := $(subst $(realpath $(objtree))/,,$(X509_CERTIFICATES-raw)) +X509_CERTIFICATES-y := $(wildcard *.x509) +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) +ifneq ($(objtree),$(srctree)) +X509_CERTIFICATES += $(sort $(wildcard $(srctree)/*.x509)) +endif ifeq ($(X509_CERTIFICATES),) $(warning *** No X.509 certificates found ***) -- 1.9.2
| |