* [PATCH] X.509: Fix certificate gathering again @ 2014-10-08 13:03 Michal Marek 2015-02-19 12:26 ` David Howells 0 siblings, 1 reply; 4+ messages in thread From: Michal Marek @ 2014-10-08 13:03 UTC (permalink / raw) To: David Howells, keyrings; +Cc: linux-kernel Commit d7ec435f (X.509: Fix certificate gathering) fixed the issue of changing .x509.list, but in the CONFIG_MODULE_SIG=y case, it assumed that $(objtree) is an absolute path. Commit 7e1c0477 (kbuild: Use relative path for $(objtree)) broke this assumption and we get uncecessary rebuilds again. Instead of prepending the absolute path and stripping it again, just check if $(srctree) and $(objtree) are different directories and add $(srctree)/*.x509 only in such case. Fixes: 7e1c047 (kbuild: Use relative path for $(objtree)) Cc: stable@vger.kernel.org Signed-off-by: Michal Marek <mmarek@suse.cz> --- kernel/Makefile | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/kernel/Makefile b/kernel/Makefile index dc5c775..7cf32cf 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -123,11 +123,12 @@ $(obj)/config_data.h: $(obj)/config_data.gz FORCE # ############################################################################### ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) -X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509) -X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509 -X509_CERTIFICATES-raw := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \ - $(or $(realpath $(CERT)),$(CERT)))) -X509_CERTIFICATES := $(subst $(realpath $(objtree))/,,$(X509_CERTIFICATES-raw)) +X509_CERTIFICATES-y := $(wildcard *.x509) +ifneq ($(objtree),$(srctree)) +X509_CERTIFICATES-y += $(wildcard $(srctree)/*.x509) +endif +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) ifeq ($(X509_CERTIFICATES),) $(warning *** No X.509 certificates found ***) -- 1.8.4.5 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] X.509: Fix certificate gathering again 2014-10-08 13:03 [PATCH] X.509: Fix certificate gathering again Michal Marek @ 2015-02-19 12:26 ` David Howells 2015-02-20 13:52 ` Michal Marek 0 siblings, 1 reply; 4+ messages in thread From: David Howells @ 2015-02-19 12:26 UTC (permalink / raw) To: Michal Marek; +Cc: dhowells, keyrings, linux-kernel Michal Marek <mmarek@suse.cz> wrote: > +X509_CERTIFICATES-y := $(wildcard *.x509) > +ifneq ($(objtree),$(srctree)) > +X509_CERTIFICATES-y += $(wildcard $(srctree)/*.x509) > +endif > +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 > +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) What will happen if there's a "signing_key.x509" in the source tree when O= is used? David ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] X.509: Fix certificate gathering again 2015-02-19 12:26 ` David Howells @ 2015-02-20 13:52 ` Michal Marek 2015-02-20 22:10 ` Michal Marek 0 siblings, 1 reply; 4+ messages in thread From: Michal Marek @ 2015-02-20 13:52 UTC (permalink / raw) To: David Howells; +Cc: keyrings, linux-kernel On 2015-02-19 13:26, David Howells wrote: > Michal Marek <mmarek@suse.cz> wrote: > >> +X509_CERTIFICATES-y := $(wildcard *.x509) >> +ifneq ($(objtree),$(srctree)) >> +X509_CERTIFICATES-y += $(wildcard $(srctree)/*.x509) >> +endif >> +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 >> +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) > > What will happen if there's a "signing_key.x509" in the source tree when O= is > used? It will fail. So the patch needs more work, thanks for the review. Michal ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] X.509: Fix certificate gathering again 2015-02-20 13:52 ` Michal Marek @ 2015-02-20 22:10 ` Michal Marek 0 siblings, 0 replies; 4+ messages in thread From: Michal Marek @ 2015-02-20 22:10 UTC (permalink / raw) To: David Howells; +Cc: keyrings, linux-kernel On Fri, Feb 20, 2015 at 02:52:14PM +0100, Michal Marek wrote: > On 2015-02-19 13:26, David Howells wrote: > > Michal Marek <mmarek@suse.cz> wrote: > > > >> +X509_CERTIFICATES-y := $(wildcard *.x509) > >> +ifneq ($(objtree),$(srctree)) > >> +X509_CERTIFICATES-y += $(wildcard $(srctree)/*.x509) > >> +endif > >> +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 > >> +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) > > > > What will happen if there's a "signing_key.x509" in the source tree when O= is > > used? > > It will fail. So the patch needs more work, thanks for the review. OK, this works for me and I finally understand why :). The problem is that whatever file make sees (as a target or dependency) first, it will prefer it for the purpose of VPATH search, so the right signing_key.x509 must come first. Unfortunately, using 'vpath %.x509' does not do the trick, because this merely says not to use any special VPATH for files matching this pattern, but it does not avoid the global VPATH. >From 1774298ef0fa770cd7e8810ed57ceb4e8a7c5def Mon Sep 17 00:00:00 2001 From: Michal Marek <mmarek@suse.cz> Date: Wed, 8 Oct 2014 13:15:28 +0200 Subject: [PATCH] X.509: Fix certificate gathering again Commit d7ec435f (X.509: Fix certificate gathering) fixed the issue of changing .x509.list, but in the CONFIG_MODULE_SIG=y case, it assumed that $(objtree) was an absolute path. Commit 7e1c0477 (kbuild: Use relative path for $(objtree)) broke this assumption and we get uncecessary rebuilds again, due to ./signing_key.x509 changing to signing_key.x509. Instead of prepending the absolute path and stripping it again, just check if $(srctree) and $(objtree) are different directories and add $(srctree)/*.x509 only in such case. However, such fix causes a different issue, namely that a potential $(srctree)/signing_key.x509 appears before the to-be-generated signing_key.x509 in the sorted list, and make remembers this file for the purpose of VPATH search. It worked previously, because ./signing_key.x509 sorts before any absolute path. Solve this by sorting the $(objtree) and $(srctree) files separately, to ensure that signing_key.x509 appears before anything from $(srctree). Signed-off-by: Michal Marek <mmarek@suse.cz> --- kernel/Makefile | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/kernel/Makefile b/kernel/Makefile index 1408b33..792e043 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -117,17 +117,18 @@ $(obj)/config_data.h: $(obj)/config_data.gz FORCE # boot. # # We look in the source root and the build root for all files whose name ends -# in ".x509". Unfortunately, this will generate duplicate filenames, so we -# have make canonicalise the pathnames and then sort them to discard the -# duplicates. +# in ".x509". We put the $(objtree) certificates before those from $(srctree), +# so that a potential signing_key.x509 file from $(srctree) does not take +# precedence. # ############################################################################### ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) -X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509) -X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509 -X509_CERTIFICATES-raw := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \ - $(or $(realpath $(CERT)),$(CERT)))) -X509_CERTIFICATES := $(subst $(realpath $(objtree))/,,$(X509_CERTIFICATES-raw)) +X509_CERTIFICATES-y := $(wildcard *.x509) +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) +ifneq ($(objtree),$(srctree)) +X509_CERTIFICATES += $(sort $(wildcard $(srctree)/*.x509)) +endif ifeq ($(X509_CERTIFICATES),) $(warning *** No X.509 certificates found ***) -- 1.9.2 ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-02-20 22:10 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2014-10-08 13:03 [PATCH] X.509: Fix certificate gathering again Michal Marek 2015-02-19 12:26 ` David Howells 2015-02-20 13:52 ` Michal Marek 2015-02-20 22:10 ` Michal Marek
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox