Re: [PATCH v3 01/28] Add boot-certificates to s390-ccw-virtio machine type option

[Jared Rossi <jrossi@linux.ibm.com>]

On 6/20/25 11:45 AM, Zhuoying Cai wrote:
> On 6/6/25 10:00 AM, Daniel P. Berrangé wrote:
>> On Wed, Jun 04, 2025 at 05:56:29PM -0400, Zhuoying Cai wrote:
>>> Add boot-certificates as a parameter of s390-ccw-virtio machine type option.
>>>
>>> The `boot-certificates=/path/dir:/path/file` parameter is implemented
>>> to provide path to either a directory or a single certificate.
>>>
>>> Multiple paths can be delineated using a colon.
>> How do users specify paths which contain a colon as a valid
>> character ?
>>
> It was suggested to separate lists of directories and files with a
> colon, following the convention used by the shell PATH variable. As the
> colon serves as a delimiter, it’s expected that individual paths do not
> contain any colon characters.

I'm not sure if I understand why this is needed.  Why would someone want 
to have the certificates in two distinct locations, as opposed to all in 
one directory or in sub-directories of a single main certificate 
directory? Supporting only one path would simplify both the 
implementation and the usage.  Could we just not allow multiple paths, 
or is there a use case that requires it?

> [snip..]
>