[PATCH 0/5] certs: various cleanups of certs/Makefile

[PATCH 0/5] certs: various cleanups of certs/Makefile

[Masahiro Yamada]

Masahiro Yamada (5):
  certs: remove meaningless $(error ...) in certs/Makefile
  certs: check-in the default x509 config file
  certs: remove noisy messages while generating the signing key
  certs: use 'cmd' to hide openssl output in silent builds more simply
  certs: use if_changed to re-generate the key when the key type is
    changed

 certs/Makefile            | 74 ++++++++-------------------------------
 certs/default_x509.genkey | 17 +++++++++
 2 files changed, 32 insertions(+), 59 deletions(-)
 create mode 100644 certs/default_x509.genkey

-- 
2.30.2

[PATCH 1/5] certs: remove meaningless $(error ...) in certs/Makefile

[Masahiro Yamada]

CONFIG_MODULE_SIG_HASH is defined by init/Kconfig. This $(error ...) is
never reachable. (If it is, you need to fix the bug.)

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---

 certs/Makefile | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/certs/Makefile b/certs/Makefile
index 279433783b10..db1fd2f4b950 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -50,9 +50,6 @@ ifdef SIGN_KEY
 # fail and that the kernel may be used afterwards.
 #
 ###############################################################################
-ifndef CONFIG_MODULE_SIG_HASH
-$(error Could not determine digest type to use from kernel config)
-endif
 
 redirect_openssl	= 2>&1
 quiet_redirect_openssl	= 2>&1
-- 
2.30.2

[PATCH 2/5] certs: check-in the default x509 config file

[Masahiro Yamada]

When x509.genkey is created, it prints a log:

  Generating X.509 key generation config

..., which is not the ordinary Kbuild log style.

Check-in the default config as certs/default_x509.genkey to make it
readable, and copy it to certs/x509.genkey if it is not present.

The log is shown in the Kbuild style.

  COPY    certs/x509.genkey

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---

 certs/Makefile            | 24 ++++++------------------
 certs/default_x509.genkey | 17 +++++++++++++++++
 2 files changed, 23 insertions(+), 18 deletions(-)
 create mode 100644 certs/default_x509.genkey

diff --git a/certs/Makefile b/certs/Makefile
index db1fd2f4b950..fc94a260e3f3 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -98,25 +98,13 @@ $(obj)/signing_key.pem: $(obj)/x509.genkey
 	@$(kecho) "### Key pair generated."
 	@$(kecho) "###"
 
+quiet_cmd_copy_x509_config = COPY    $@
+      cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@
+
+# You can provide your own config file. If not present, copy the default one.
 $(obj)/x509.genkey:
-	@$(kecho) Generating X.509 key generation config
-	@echo  >$@ "[ req ]"
-	@echo >>$@ "default_bits = 4096"
-	@echo >>$@ "distinguished_name = req_distinguished_name"
-	@echo >>$@ "prompt = no"
-	@echo >>$@ "string_mask = utf8only"
-	@echo >>$@ "x509_extensions = myexts"
-	@echo >>$@
-	@echo >>$@ "[ req_distinguished_name ]"
-	@echo >>$@ "#O = Unspecified company"
-	@echo >>$@ "CN = Build time autogenerated kernel key"
-	@echo >>$@ "#emailAddress = unspecified.user@unspecified.company"
-	@echo >>$@
-	@echo >>$@ "[ myexts ]"
-	@echo >>$@ "basicConstraints=critical,CA:FALSE"
-	@echo >>$@ "keyUsage=digitalSignature"
-	@echo >>$@ "subjectKeyIdentifier=hash"
-	@echo >>$@ "authorityKeyIdentifier=keyid"
+	$(call cmd,copy_x509_config)
+
 endif # CONFIG_MODULE_SIG_KEY
 
 $(eval $(call config_filename,MODULE_SIG_KEY))
diff --git a/certs/default_x509.genkey b/certs/default_x509.genkey
new file mode 100644
index 000000000000..d4c6628cb8e5
--- /dev/null
+++ b/certs/default_x509.genkey
@@ -0,0 +1,17 @@
+[ req ]
+default_bits = 4096
+distinguished_name = req_distinguished_name
+prompt = no
+string_mask = utf8only
+x509_extensions = myexts
+
+[ req_distinguished_name ]
+#O = Unspecified company
+CN = Build time autogenerated kernel key
+#emailAddress = unspecified.user@unspecified.company
+
+[ myexts ]
+basicConstraints=critical,CA:FALSE
+keyUsage=digitalSignature
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid
-- 
2.30.2

[PATCH 3/5] certs: remove noisy messages while generating the signing key

[Masahiro Yamada]

When you run Kbuild with the parallel option -j, the messages from this
rule and others are interleaved, like follows:

    ###
      CC      arch/x86/mm/pat/set_memory.o
    ### Now generating an X.509 key pair to be used for signing modules.
    ###
    ### If this takes a long time, you might wish to run rngd in the
    ### background to keep the supply of entropy topped up.  It
      CC      arch/x86/events/intel/bts.o
      HDRTEST usr/include/linux/qnx4_fs.h
      CC      arch/x86/events/zhaoxin/core.o
    ### needs to be run as root, and uses a hardware random
    ### number generator if one is available.
      AR      init/built-in.a
    ###

On modern machines, it does not take a long time to generate the key.

Remove the ugly log messages.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---

 certs/Makefile | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/certs/Makefile b/certs/Makefile
index fc94a260e3f3..a8c9abceef00 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -80,23 +80,12 @@ endif
 endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA
 
 $(obj)/signing_key.pem: $(obj)/x509.genkey
-	@$(kecho) "###"
-	@$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
-	@$(kecho) "###"
-	@$(kecho) "### If this takes a long time, you might wish to run rngd in the"
-	@$(kecho) "### background to keep the supply of entropy topped up.  It"
-	@$(kecho) "### needs to be run as root, and uses a hardware random"
-	@$(kecho) "### number generator if one is available."
-	@$(kecho) "###"
 	$(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
 		-batch -x509 -config $(obj)/x509.genkey \
 		-outform PEM -out $(obj)/signing_key.pem \
 		-keyout $(obj)/signing_key.pem \
 		$(keytype_openssl) \
 		$($(quiet)redirect_openssl)
-	@$(kecho) "###"
-	@$(kecho) "### Key pair generated."
-	@$(kecho) "###"
 
 quiet_cmd_copy_x509_config = COPY    $@
       cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@
-- 
2.30.2

[PATCH 4/5] certs: use 'cmd' to hide openssl output in silent builds more simply

[Masahiro Yamada]

Commit 5d06ee20b662 ("modsign: hide openssl output in silent builds")
silenced the key generation log from openssl in silent builds.

Since commit 174a1dcc9642 ("kbuild: sink stdout from cmd for silent
build"), the 'cmd' macro can handle it in a cleaner way.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---

 certs/Makefile | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/certs/Makefile b/certs/Makefile
index a8c9abceef00..fdf206022113 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -51,9 +51,6 @@ ifdef SIGN_KEY
 #
 ###############################################################################
 
-redirect_openssl	= 2>&1
-quiet_redirect_openssl	= 2>&1
-silent_redirect_openssl = 2>/dev/null
 openssl_available       = $(shell openssl help 2>/dev/null && echo yes)
 
 # We do it this way rather than having a boolean option for enabling an
@@ -79,13 +76,16 @@ $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.p
 endif
 endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA
 
-$(obj)/signing_key.pem: $(obj)/x509.genkey
-	$(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
+quiet_cmd_gen_key = GENKEY  $@
+      cmd_gen_key = openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
 		-batch -x509 -config $(obj)/x509.genkey \
 		-outform PEM -out $(obj)/signing_key.pem \
 		-keyout $(obj)/signing_key.pem \
 		$(keytype_openssl) \
-		$($(quiet)redirect_openssl)
+		2>&1
+
+$(obj)/signing_key.pem: $(obj)/x509.genkey
+	$(call cmd,gen_key)
 
 quiet_cmd_copy_x509_config = COPY    $@
       cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@
-- 
2.30.2

[PATCH 5/5] certs: use if_changed to re-generate the key when the key type is changed

[Masahiro Yamada]

If the key type of the existing signing key does not match to
CONFIG_MODULE_SIG_KEY_TYPE_*, the Makefile removes it so that it is
re-generated.

Use if_changed so that the key is re-generated when the key type is
changed (that is, the openssl command line is changed).

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---

 certs/Makefile | 30 ++++++------------------------
 1 file changed, 6 insertions(+), 24 deletions(-)

diff --git a/certs/Makefile b/certs/Makefile
index fdf206022113..a702b70f3cb9 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -51,41 +51,23 @@ ifdef SIGN_KEY
 #
 ###############################################################################
 
-openssl_available       = $(shell openssl help 2>/dev/null && echo yes)
-
 # We do it this way rather than having a boolean option for enabling an
 # external private key, because 'make randconfig' might enable such a
 # boolean option and we unfortunately can't make it depend on !RANDCONFIG.
 ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
 
-ifeq ($(openssl_available),yes)
-X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null)
-endif
-
-# Support user changing key type
-ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA
-keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1
-ifeq ($(openssl_available),yes)
-$(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))
-endif
-endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA
-
-ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA
-ifeq ($(openssl_available),yes)
-$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))
-endif
-endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA
+keytype-$(CONFIG_MODULE_SIG_KEY_TYPE_ECDSA) := -newkey ec -pkeyopt ec_paramgen_curve:secp384r1
 
 quiet_cmd_gen_key = GENKEY  $@
       cmd_gen_key = openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
 		-batch -x509 -config $(obj)/x509.genkey \
 		-outform PEM -out $(obj)/signing_key.pem \
-		-keyout $(obj)/signing_key.pem \
-		$(keytype_openssl) \
-		2>&1
+		-keyout $(obj)/signing_key.pem $(keytype-y) 2>&1
+
+$(obj)/signing_key.pem: $(obj)/x509.genkey FORCE
+	$(call if_changed,gen_key)
 
-$(obj)/signing_key.pem: $(obj)/x509.genkey
-	$(call cmd,gen_key)
+targets += signing_key.pem
 
 quiet_cmd_copy_x509_config = COPY    $@
       cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@
-- 
2.30.2

Re: [PATCH 3/5] certs: remove noisy messages while generating the signing key

[Arnd Bergmann]

On Fri, Nov 5, 2021 at 4:59 AM Masahiro Yamada <masahiroy@kernel.org> wrote:
>
> When you run Kbuild with the parallel option -j, the messages from this
> rule and others are interleaved, like follows:
>
>     ###
>       CC      arch/x86/mm/pat/set_memory.o
>     ### Now generating an X.509 key pair to be used for signing modules.
>     ###
>     ### If this takes a long time, you might wish to run rngd in the
>     ### background to keep the supply of entropy topped up.  It
>       CC      arch/x86/events/intel/bts.o
>       HDRTEST usr/include/linux/qnx4_fs.h
>       CC      arch/x86/events/zhaoxin/core.o
>     ### needs to be run as root, and uses a hardware random
>     ### number generator if one is available.
>       AR      init/built-in.a
>     ###
>
> On modern machines, it does not take a long time to generate the key.
>
> Remove the ugly log messages.

I have no real objection to this, but I would still point out that
the warning message may still be helpful for those building
in a virtual machine or some other environment without a hwrng,
and that most people wouldn't see the message anway if they
built with 'make -s', at least after my 5d06ee20b662 ("modsign:
hide openssl output in silent builds").

I wonder if it would be time to change the default output to
be more quiet, by degrading it one level, like

                    old           new
only warnings       make -s       make
CC file.o           make          make V=1
full cmdline        make V=1      make V=2

This would take some time to adjust to, but it does sound like
a more reasonable default. Does anyone still build without -s
in practice?

        Arnd

Re: [PATCH 3/5] certs: remove noisy messages while generating the signing key

[Masahiro Yamada]

On Fri, Nov 5, 2021 at 4:34 PM Arnd Bergmann <arnd@arndb.de> wrote:
>
> On Fri, Nov 5, 2021 at 4:59 AM Masahiro Yamada <masahiroy@kernel.org> wrote:
> >
> > When you run Kbuild with the parallel option -j, the messages from this
> > rule and others are interleaved, like follows:
> >
> >     ###
> >       CC      arch/x86/mm/pat/set_memory.o
> >     ### Now generating an X.509 key pair to be used for signing modules.
> >     ###
> >     ### If this takes a long time, you might wish to run rngd in the
> >     ### background to keep the supply of entropy topped up.  It
> >       CC      arch/x86/events/intel/bts.o
> >       HDRTEST usr/include/linux/qnx4_fs.h
> >       CC      arch/x86/events/zhaoxin/core.o
> >     ### needs to be run as root, and uses a hardware random
> >     ### number generator if one is available.
> >       AR      init/built-in.a
> >     ###
> >
> > On modern machines, it does not take a long time to generate the key.
> >
> > Remove the ugly log messages.
>
> I have no real objection to this, but I would still point out that
> the warning message may still be helpful for those building
> in a virtual machine or some other environment without a hwrng,
> and that most people wouldn't see the message anway if they
> built with 'make -s', at least after my 5d06ee20b662 ("modsign:
> hide openssl output in silent builds").
>
> I wonder if it would be time to change the default output to
> be more quiet, by degrading it one level, like
>
>                     old           new
> only warnings       make -s       make
> CC file.o           make          make V=1
> full cmdline        make V=1      make V=2
>
> This would take some time to adjust to, but it does sound like
> a more reasonable default. Does anyone still build without -s
> in practice?


Yes, me.

I usually build normally (CC file.o log style).

I am opposed to making silent builds default.

People would be upset if they do 'make' to
see nothing in the terminal.




-- 
Best Regards
Masahiro Yamada

Re: [PATCH 0/5] certs: various cleanups of certs/Makefile

[Masahiro Yamada]

On Fri, Nov 5, 2021 at 1:00 PM Masahiro Yamada <masahiroy@kernel.org> wrote:
>
>
>
>
> Masahiro Yamada (5):
>   certs: remove meaningless $(error ...) in certs/Makefile
>   certs: check-in the default x509 config file
>   certs: remove noisy messages while generating the signing key
>   certs: use 'cmd' to hide openssl output in silent builds more simply
>   certs: use if_changed to re-generate the key when the key type is
>     changed
>
>  certs/Makefile            | 74 ++++++++-------------------------------
>  certs/default_x509.genkey | 17 +++++++++
>  2 files changed, 32 insertions(+), 59 deletions(-)
>  create mode 100644 certs/default_x509.genkey
>
> --
> 2.30.2
>

Applied to linux-kbuild because this series is a prerequisite
of the next kbuild work.


-- 
Best Regards
Masahiro Yamada