lkml.org 
[lkml]   [2015]   [May]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/3] X.509: Fix certificate gathering again
    Date
    Commit d7ec435f (X.509: Fix certificate gathering) fixed the issue of
    changing .x509.list, but in the CONFIG_MODULE_SIG=y case, it assumed
    that $(objtree) was an absolute path. Commit 7e1c0477 (kbuild: Use
    relative path for $(objtree)) broke this assumption and we get
    uncecessary rebuilds again, due to ./signing_key.x509 changing to
    signing_key.x509. Instead of prepending the absolute path and
    stripping it again, just check if $(srctree) and $(objtree) are
    different directories and add $(srctree)/*.x509 only in such case.

    However, such fix causes a different issue, namely that a potential
    $(srctree)/signing_key.x509 appears before the to-be-generated
    signing_key.x509 in the sorted list, and make remembers this file for
    the purpose of VPATH search. It worked previously, because
    ./signing_key.x509 sorts before any absolute path. Solve this by sorting
    the $(objtree) and $(srctree) files separately, to ensure that
    signing_key.x509 appears before anything from $(srctree).

    Signed-off-by: Michal Marek <mmarek@suse.cz>
    ---
    kernel/Makefile | 17 +++++++++--------
    1 file changed, 9 insertions(+), 8 deletions(-)

    diff --git a/kernel/Makefile b/kernel/Makefile
    index 60c302c..dc78819 100644
    --- a/kernel/Makefile
    +++ b/kernel/Makefile
    @@ -119,17 +119,18 @@ $(obj)/config_data.h: $(obj)/config_data.gz FORCE
    # boot.
    #
    # We look in the source root and the build root for all files whose name ends
    -# in ".x509". Unfortunately, this will generate duplicate filenames, so we
    -# have make canonicalise the pathnames and then sort them to discard the
    -# duplicates.
    +# in ".x509". We put the $(objtree) certificates before those from $(srctree),
    +# so that a potential signing_key.x509 file from $(srctree) does not take
    +# precedence.
    #
    ###############################################################################
    ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
    -X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509)
    -X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509
    -X509_CERTIFICATES-raw := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \
    - $(or $(realpath $(CERT)),$(CERT))))
    -X509_CERTIFICATES := $(subst $(realpath $(objtree))/,,$(X509_CERTIFICATES-raw))
    +X509_CERTIFICATES-y := $(wildcard *.x509)
    +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509
    +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y))
    +ifneq ($(objtree),$(srctree))
    +X509_CERTIFICATES += $(sort $(wildcard $(srctree)/*.x509))
    +endif

    ifeq ($(X509_CERTIFICATES),)
    $(warning *** No X.509 certificates found ***)
    --
    2.1.4


    \
     
     \ /
      Last update: 2015-05-20 03:41    [W:4.366 / U:0.204 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site