Re: [PATCH 0/2] Add bulk signing support for PKCS#11 keys

[Eric Biggers <ebiggers@kernel.org>]

On Fri, Oct 09, 2026 at 06:13:22PM +0200, Massimiliano Marretta wrote:
> Yes, I have been following that series. It is a useful approach for
> its stated goal, and I am not arguing against it.
> 
> However, in our case it is not applicable. Our product depends on
> Wi-Fi modules from Ezurio that are built out-of-tree against the
> Engicam/NXP kernel. In this case the module hash is not known at
> vmlinux link time, so a Merkle tree computed during the kernel build
> cannot cover them.

But do you actually deploy a kernel (maybe with some in-tree modules),
and then deploy the out-of-tree modules later at some totally separate
time?

Or do you actually just collect both in-tree and out-of-tree artifacts
into a build and deploy that, and the fact that the in-tree build
doesn't have visibility into out-of-tree modules built separately is
just a limitation of the build system?  If so, asymmetric signatures
seem like a really unnecessarily complicated workaround for that.

- Eric