Re: [PATCH bpf-next v6 0/8] Verify BPF signed loader at load time

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <memxor@gmail.com>:

On Wed,  8 Jul 2026 09:53:35 +0200 you wrote:
> The BPF signing scheme signs a light skeleton's loader program and lets
> the loader vouch for everything else: bpftool bakes the SHA256 of the
> metadata map into the loader's instructions, signs the instructions, and
> the loader compares the (frozen, exclusive) map against that hash from
> within BPF once it runs. The construction is sound as a trusted hash
> chain, but the kernel itself never attests the metadata, and that split
> has been the recurring objection from the LSM / integrity side since the
> scheme was proposed.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v6,1/8] bpf: Resolve and cache fd_array objects at load time
    https://git.kernel.org/bpf/bpf-next/c/d5a85392392c
  - [bpf-next,v6,2/8] bpf: Verify signed loader metadata at load time
    https://git.kernel.org/bpf/bpf-next/c/b707068e0ed9
  - [bpf-next,v6,3/8] libbpf: Drop in-loader metadata check for load-time verification
    https://git.kernel.org/bpf/bpf-next/c/a2d784869a0f
  - [bpf-next,v6,4/8] bpftool: Check EVP_Digest when computing excl_prog_hash
    https://git.kernel.org/bpf/bpf-next/c/576bcaa1f5c2
  - [bpf-next,v6,5/8] bpftool: Cover loader metadata with the program signature
    https://git.kernel.org/bpf/bpf-next/c/92c7717981bb
  - [bpf-next,v6,6/8] selftests/bpf: Adjust bpf_map layout in verifier_map_ptr
    https://git.kernel.org/bpf/bpf-next/c/77e5f3c91453
  - [bpf-next,v6,7/8] selftests/bpf: Verify load-time signed loader metadata
    https://git.kernel.org/bpf/bpf-next/c/99b321dde704
  - [bpf-next,v6,8/8] Documentation/bpf: Add BPF signing and enforcement doc
    https://git.kernel.org/bpf/bpf-next/c/84c42f515f18

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html