* [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-11 17:22 [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist Masahiro Yamada
@ 2022-06-11 17:22 ` Masahiro Yamada
2022-06-13 12:34 ` Mickaël Salaün
2022-06-15 18:46 ` Jarkko Sakkinen
2022-06-11 17:22 ` [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/ Masahiro Yamada
` (3 subsequent siblings)
4 siblings, 2 replies; 22+ messages in thread
From: Masahiro Yamada @ 2022-06-11 17:22 UTC (permalink / raw)
To: linux-kbuild
Cc: David Howells, Jarkko Sakkinen,
Micka���l Sala���n,
Masahiro Yamada, David Woodhouse, keyrings, linux-kernel
Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
valid") was applied 8 months after the submission.
In the meantime, the base code had been removed by commit b8c96a6b466c
("certs: simplify $(srctree)/ handling and remove config_filename
macro").
Fix the Makefile.
Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
included from certs/blacklist_hashes.c and also works as a timestamp.
Send error messages from check-blacklist-hashes.awk to stderr instead
of stdout.
Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---
certs/.gitignore | 2 +-
certs/Makefile | 20 ++++++++++----------
certs/blacklist_hashes.c | 2 +-
3 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/certs/.gitignore b/certs/.gitignore
index 56637aceaf81..cec5465f31c1 100644
--- a/certs/.gitignore
+++ b/certs/.gitignore
@@ -1,5 +1,5 @@
# SPDX-License-Identifier: GPL-2.0-only
-/blacklist_hashes_checked
+/blacklist_hash_list
/extract-cert
/x509_certificate_list
/x509_revocation_list
diff --git a/certs/Makefile b/certs/Makefile
index cb1a9da3fc58..a8d628fd5f7b 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
-quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
- cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
-$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
+$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
+CFLAGS_blacklist_hashes.o := -I $(obj)
-$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
+quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
+ cmd_check_and_copy_blacklist_hash_list = \
+ $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
+ cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
-CFLAGS_blacklist_hashes.o += -I$(srctree)
-
-targets += blacklist_hashes_checked
-$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
- $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
+$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
+ $(call if_changed,check_and_copy_blacklist_hash_list)
obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
else
obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
endif
+targets += blacklist_hash_list
quiet_cmd_extract_certs = CERT $@
cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
@@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
$(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
$(call if_changed,extract_certs)
-targets += x509_certificate_list blacklist_hashes_checked
+targets += x509_certificate_list
# If module signing is requested, say by allyesconfig, but a key has not been
# supplied, then one will need to be generated to make sure the build does not
diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
index d5961aa3d338..86d66fe11348 100644
--- a/certs/blacklist_hashes.c
+++ b/certs/blacklist_hashes.c
@@ -2,6 +2,6 @@
#include "blacklist.h"
const char __initconst *const blacklist_hashes[] = {
-#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
+#include "blacklist_hash_list"
, NULL
};
--
2.32.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-11 17:22 ` [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build Masahiro Yamada
@ 2022-06-13 12:34 ` Mickaël Salaün
2022-06-13 14:55 ` Masahiro Yamada
2022-06-15 18:48 ` Jarkko Sakkinen
2022-06-15 18:46 ` Jarkko Sakkinen
1 sibling, 2 replies; 22+ messages in thread
From: Mickaël Salaün @ 2022-06-13 12:34 UTC (permalink / raw)
To: Masahiro Yamada, linux-kbuild
Cc: David Howells, Jarkko Sakkinen, David Woodhouse, keyrings,
linux-kernel, Eric Snowberg, Herbert Xu, Tyler Hicks
On 11/06/2022 19:22, Masahiro Yamada wrote:
> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> valid") was applied 8 months after the submission.
>
> In the meantime, the base code had been removed by commit b8c96a6b466c
> ("certs: simplify $(srctree)/ handling and remove config_filename
> macro").
>
> Fix the Makefile.
>
> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> included from certs/blacklist_hashes.c and also works as a timestamp.
>
> Send error messages from check-blacklist-hashes.awk to stderr instead
> of stdout.
>
> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
As a side note, it may let an orphan certs/blacklist_hashes_checked file
but we can't really do something about that and it's OK.
Thanks!
> ---
>
> certs/.gitignore | 2 +-
> certs/Makefile | 20 ++++++++++----------
> certs/blacklist_hashes.c | 2 +-
> 3 files changed, 12 insertions(+), 12 deletions(-)
>
> diff --git a/certs/.gitignore b/certs/.gitignore
> index 56637aceaf81..cec5465f31c1 100644
> --- a/certs/.gitignore
> +++ b/certs/.gitignore
> @@ -1,5 +1,5 @@
> # SPDX-License-Identifier: GPL-2.0-only
> -/blacklist_hashes_checked
> +/blacklist_hash_list
> /extract-cert
> /x509_certificate_list
> /x509_revocation_list
> diff --git a/certs/Makefile b/certs/Makefile
> index cb1a9da3fc58..a8d628fd5f7b 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
>
> -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> +CFLAGS_blacklist_hashes.o := -I $(obj)
>
> -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> + cmd_check_and_copy_blacklist_hash_list = \
> + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>
> -CFLAGS_blacklist_hashes.o += -I$(srctree)
> -
> -targets += blacklist_hashes_checked
> -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> + $(call if_changed,check_and_copy_blacklist_hash_list)
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> else
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> endif
> +targets += blacklist_hash_list
>
> quiet_cmd_extract_certs = CERT $@
> cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> $(call if_changed,extract_certs)
>
> -targets += x509_certificate_list blacklist_hashes_checked
> +targets += x509_certificate_list
>
> # If module signing is requested, say by allyesconfig, but a key has not been
> # supplied, then one will need to be generated to make sure the build does not
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index d5961aa3d338..86d66fe11348 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -2,6 +2,6 @@
> #include "blacklist.h"
>
> const char __initconst *const blacklist_hashes[] = {
> -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> +#include "blacklist_hash_list"
> , NULL
> };
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-13 12:34 ` Mickaël Salaün
@ 2022-06-13 14:55 ` Masahiro Yamada
2022-06-13 18:06 ` Mickaël Salaün
2022-06-15 18:48 ` Jarkko Sakkinen
1 sibling, 1 reply; 22+ messages in thread
From: Masahiro Yamada @ 2022-06-13 14:55 UTC (permalink / raw)
To: Mickaël Salaün
Cc: Linux Kbuild mailing list, David Howells, Jarkko Sakkinen,
David Woodhouse, keyrings, Linux Kernel Mailing List,
Eric Snowberg, Herbert Xu, Tyler Hicks
On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <mic@digikod.net> wrote:
>
>
>
> On 11/06/2022 19:22, Masahiro Yamada wrote:
> > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > valid") was applied 8 months after the submission.
> >
> > In the meantime, the base code had been removed by commit b8c96a6b466c
> > ("certs: simplify $(srctree)/ handling and remove config_filename
> > macro").
> >
> > Fix the Makefile.
> >
> > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > included from certs/blacklist_hashes.c and also works as a timestamp.
> >
> > Send error messages from check-blacklist-hashes.awk to stderr instead
> > of stdout.
> >
> > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
>
> Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
>
> As a side note, it may let an orphan certs/blacklist_hashes_checked file
> but we can't really do something about that and it's OK.
GNU Make uses timestamps of files for dependency tracking,
so Kbuild keeps all intermediate files.
Keeping certs/blacklist_hashes_checked
is the right thing to do.
> Thanks!
>
> > ---
> >
> > certs/.gitignore | 2 +-
> > certs/Makefile | 20 ++++++++++----------
> > certs/blacklist_hashes.c | 2 +-
> > 3 files changed, 12 insertions(+), 12 deletions(-)
> >
> > diff --git a/certs/.gitignore b/certs/.gitignore
> > index 56637aceaf81..cec5465f31c1 100644
> > --- a/certs/.gitignore
> > +++ b/certs/.gitignore
> > @@ -1,5 +1,5 @@
> > # SPDX-License-Identifier: GPL-2.0-only
> > -/blacklist_hashes_checked
> > +/blacklist_hash_list
> > /extract-cert
> > /x509_certificate_list
> > /x509_revocation_list
> > diff --git a/certs/Makefile b/certs/Makefile
> > index cb1a9da3fc58..a8d628fd5f7b 100644
> > --- a/certs/Makefile
> > +++ b/certs/Makefile
> > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> > - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> >
> > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > +CFLAGS_blacklist_hashes.o := -I $(obj)
> >
> > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > + cmd_check_and_copy_blacklist_hash_list = \
> > + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> >
> > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > -
> > -targets += blacklist_hashes_checked
> > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > + $(call if_changed,check_and_copy_blacklist_hash_list)
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > else
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > endif
> > +targets += blacklist_hash_list
> >
> > quiet_cmd_extract_certs = CERT $@
> > cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > $(call if_changed,extract_certs)
> >
> > -targets += x509_certificate_list blacklist_hashes_checked
> > +targets += x509_certificate_list
> >
> > # If module signing is requested, say by allyesconfig, but a key has not been
> > # supplied, then one will need to be generated to make sure the build does not
> > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > index d5961aa3d338..86d66fe11348 100644
> > --- a/certs/blacklist_hashes.c
> > +++ b/certs/blacklist_hashes.c
> > @@ -2,6 +2,6 @@
> > #include "blacklist.h"
> >
> > const char __initconst *const blacklist_hashes[] = {
> > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > +#include "blacklist_hash_list"
> > , NULL
> > };
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-13 14:55 ` Masahiro Yamada
@ 2022-06-13 18:06 ` Mickaël Salaün
2022-06-13 18:56 ` Masahiro Yamada
0 siblings, 1 reply; 22+ messages in thread
From: Mickaël Salaün @ 2022-06-13 18:06 UTC (permalink / raw)
To: Masahiro Yamada
Cc: Linux Kbuild mailing list, David Howells, Jarkko Sakkinen,
David Woodhouse, keyrings, Linux Kernel Mailing List,
Eric Snowberg, Herbert Xu, Tyler Hicks
On 13/06/2022 16:55, Masahiro Yamada wrote:
> On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <mic@digikod.net> wrote:
>>
>>
>>
>> On 11/06/2022 19:22, Masahiro Yamada wrote:
>>> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
>>> valid") was applied 8 months after the submission.
>>>
>>> In the meantime, the base code had been removed by commit b8c96a6b466c
>>> ("certs: simplify $(srctree)/ handling and remove config_filename
>>> macro").
>>>
>>> Fix the Makefile.
>>>
>>> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
>>> included from certs/blacklist_hashes.c and also works as a timestamp.
>>>
>>> Send error messages from check-blacklist-hashes.awk to stderr instead
>>> of stdout.
>>>
>>> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
>>> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
>>
>> Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
>>
>> As a side note, it may let an orphan certs/blacklist_hashes_checked file
>> but we can't really do something about that and it's OK.
>
>
> GNU Make uses timestamps of files for dependency tracking,
> so Kbuild keeps all intermediate files.
>
> Keeping certs/blacklist_hashes_checked
> is the right thing to do.
blacklist_hashes_checked is the file you replaced with
blacklist_hash_list, and is then not used in any Makefile anymore. There
is then no timestamp issue. I just wanted to mention that it is normal
that a git status will show it on build directories also used as source
directories that were already using such feature.
>
>
>
>> Thanks!
>>
>>> ---
>>>
>>> certs/.gitignore | 2 +-
>>> certs/Makefile | 20 ++++++++++----------
>>> certs/blacklist_hashes.c | 2 +-
>>> 3 files changed, 12 insertions(+), 12 deletions(-)
>>>
>>> diff --git a/certs/.gitignore b/certs/.gitignore
>>> index 56637aceaf81..cec5465f31c1 100644
>>> --- a/certs/.gitignore
>>> +++ b/certs/.gitignore
>>> @@ -1,5 +1,5 @@
>>> # SPDX-License-Identifier: GPL-2.0-only
>>> -/blacklist_hashes_checked
>>> +/blacklist_hash_list
>>> /extract-cert
>>> /x509_certificate_list
>>> /x509_revocation_list
>>> diff --git a/certs/Makefile b/certs/Makefile
>>> index cb1a9da3fc58..a8d628fd5f7b 100644
>>> --- a/certs/Makefile
>>> +++ b/certs/Makefile
>>> @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
>>> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
>>> obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
>>> ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
>>> -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
>>> - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
>>>
>>> -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
>>> +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
>>> +CFLAGS_blacklist_hashes.o := -I $(obj)
>>>
>>> -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
>>> +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
>>> + cmd_check_and_copy_blacklist_hash_list = \
>>> + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>>> + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>>>
>>> -CFLAGS_blacklist_hashes.o += -I$(srctree)
>>> -
>>> -targets += blacklist_hashes_checked
>>> -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
>>> - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
>>> +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
>>> + $(call if_changed,check_and_copy_blacklist_hash_list)
>>> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
>>> else
>>> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
>>> endif
>>> +targets += blacklist_hash_list
>>>
>>> quiet_cmd_extract_certs = CERT $@
>>> cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
>>> @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
>>> $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
>>> $(call if_changed,extract_certs)
>>>
>>> -targets += x509_certificate_list blacklist_hashes_checked
>>> +targets += x509_certificate_list
>>>
>>> # If module signing is requested, say by allyesconfig, but a key has not been
>>> # supplied, then one will need to be generated to make sure the build does not
>>> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
>>> index d5961aa3d338..86d66fe11348 100644
>>> --- a/certs/blacklist_hashes.c
>>> +++ b/certs/blacklist_hashes.c
>>> @@ -2,6 +2,6 @@
>>> #include "blacklist.h"
>>>
>>> const char __initconst *const blacklist_hashes[] = {
>>> -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
>>> +#include "blacklist_hash_list"
>>> , NULL
>>> };
>
>
>
> --
> Best Regards
> Masahiro Yamada
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-13 18:06 ` Mickaël Salaün
@ 2022-06-13 18:56 ` Masahiro Yamada
2022-06-13 19:14 ` Mickaël Salaün
0 siblings, 1 reply; 22+ messages in thread
From: Masahiro Yamada @ 2022-06-13 18:56 UTC (permalink / raw)
To: Mickaël Salaün
Cc: Linux Kbuild mailing list, David Howells, Jarkko Sakkinen,
David Woodhouse, keyrings, Linux Kernel Mailing List,
Eric Snowberg, Herbert Xu, Tyler Hicks
On Tue, Jun 14, 2022 at 3:06 AM Mickaël Salaün <mic@digikod.net> wrote:
>
>
> On 13/06/2022 16:55, Masahiro Yamada wrote:
> > On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <mic@digikod.net> wrote:
> >>
> >>
> >>
> >> On 11/06/2022 19:22, Masahiro Yamada wrote:
> >>> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> >>> valid") was applied 8 months after the submission.
> >>>
> >>> In the meantime, the base code had been removed by commit b8c96a6b466c
> >>> ("certs: simplify $(srctree)/ handling and remove config_filename
> >>> macro").
> >>>
> >>> Fix the Makefile.
> >>>
> >>> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> >>> included from certs/blacklist_hashes.c and also works as a timestamp.
> >>>
> >>> Send error messages from check-blacklist-hashes.awk to stderr instead
> >>> of stdout.
> >>>
> >>> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> >>> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> >>
> >> Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> >>
> >> As a side note, it may let an orphan certs/blacklist_hashes_checked file
> >> but we can't really do something about that and it's OK.
> >
> >
> > GNU Make uses timestamps of files for dependency tracking,
> > so Kbuild keeps all intermediate files.
> >
> > Keeping certs/blacklist_hashes_checked
> > is the right thing to do.
>
> blacklist_hashes_checked is the file you replaced with
> blacklist_hash_list, and is then not used in any Makefile anymore. There
> is then no timestamp issue. I just wanted to mention that it is normal
> that a git status will show it on build directories also used as source
> directories that were already using such feature.
Ah, sorry, I misunderstood your feedback.
If 'git status' is your concern,
we can add certs/blacklist_hashes_checked
to scripts/remove-stale-files.
addf466389d9d78f255e8b15ac44ab4791029852
was merged into mainline just recently, and
not contained in any release.
But, if the orphan timestamp matters, I will do it.
It is just a one-liner addition.
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-13 18:56 ` Masahiro Yamada
@ 2022-06-13 19:14 ` Mickaël Salaün
0 siblings, 0 replies; 22+ messages in thread
From: Mickaël Salaün @ 2022-06-13 19:14 UTC (permalink / raw)
To: Masahiro Yamada
Cc: Linux Kbuild mailing list, David Howells, Jarkko Sakkinen,
David Woodhouse, keyrings, Linux Kernel Mailing List,
Eric Snowberg, Herbert Xu, Tyler Hicks
On 13/06/2022 20:56, Masahiro Yamada wrote:
> On Tue, Jun 14, 2022 at 3:06 AM Mickaël Salaün <mic@digikod.net> wrote:
>>
>>
>> On 13/06/2022 16:55, Masahiro Yamada wrote:
>>> On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <mic@digikod.net> wrote:
>>>>
>>>>
>>>>
>>>> On 11/06/2022 19:22, Masahiro Yamada wrote:
>>>>> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
>>>>> valid") was applied 8 months after the submission.
>>>>>
>>>>> In the meantime, the base code had been removed by commit b8c96a6b466c
>>>>> ("certs: simplify $(srctree)/ handling and remove config_filename
>>>>> macro").
>>>>>
>>>>> Fix the Makefile.
>>>>>
>>>>> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
>>>>> included from certs/blacklist_hashes.c and also works as a timestamp.
>>>>>
>>>>> Send error messages from check-blacklist-hashes.awk to stderr instead
>>>>> of stdout.
>>>>>
>>>>> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
>>>>> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
>>>>
>>>> Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
>>>>
>>>> As a side note, it may let an orphan certs/blacklist_hashes_checked file
>>>> but we can't really do something about that and it's OK.
>>>
>>>
>>> GNU Make uses timestamps of files for dependency tracking,
>>> so Kbuild keeps all intermediate files.
>>>
>>> Keeping certs/blacklist_hashes_checked
>>> is the right thing to do.
>>
>> blacklist_hashes_checked is the file you replaced with
>> blacklist_hash_list, and is then not used in any Makefile anymore. There
>> is then no timestamp issue. I just wanted to mention that it is normal
>> that a git status will show it on build directories also used as source
>> directories that were already using such feature.
>
>
> Ah, sorry, I misunderstood your feedback.
>
> If 'git status' is your concern,
> we can add certs/blacklist_hashes_checked
> to scripts/remove-stale-files.
>
> addf466389d9d78f255e8b15ac44ab4791029852
> was merged into mainline just recently, and
> not contained in any release.
Indeed, it's all good then.
>
> But, if the orphan timestamp matters, I will do it.
> It is just a one-liner addition.
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-13 12:34 ` Mickaël Salaün
2022-06-13 14:55 ` Masahiro Yamada
@ 2022-06-15 18:48 ` Jarkko Sakkinen
2022-06-18 22:12 ` Masahiro Yamada
1 sibling, 1 reply; 22+ messages in thread
From: Jarkko Sakkinen @ 2022-06-15 18:48 UTC (permalink / raw)
To: Mickaël Salaün
Cc: Masahiro Yamada, linux-kbuild, David Howells, David Woodhouse,
keyrings, linux-kernel, Eric Snowberg, Herbert Xu, Tyler Hicks
On Mon, Jun 13, 2022 at 02:34:36PM +0200, Mickaël Salaün wrote:
>
>
> On 11/06/2022 19:22, Masahiro Yamada wrote:
> > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > valid") was applied 8 months after the submission.
> >
> > In the meantime, the base code had been removed by commit b8c96a6b466c
> > ("certs: simplify $(srctree)/ handling and remove config_filename
> > macro").
> >
> > Fix the Makefile.
> >
> > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > included from certs/blacklist_hashes.c and also works as a timestamp.
> >
> > Send error messages from check-blacklist-hashes.awk to stderr instead
> > of stdout.
> >
> > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
>
> Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
>
> As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> we can't really do something about that and it's OK.
>
> Thanks!
>
> > ---
> >
> > certs/.gitignore | 2 +-
> > certs/Makefile | 20 ++++++++++----------
> > certs/blacklist_hashes.c | 2 +-
> > 3 files changed, 12 insertions(+), 12 deletions(-)
> >
> > diff --git a/certs/.gitignore b/certs/.gitignore
> > index 56637aceaf81..cec5465f31c1 100644
> > --- a/certs/.gitignore
> > +++ b/certs/.gitignore
> > @@ -1,5 +1,5 @@
> > # SPDX-License-Identifier: GPL-2.0-only
> > -/blacklist_hashes_checked
> > +/blacklist_hash_list
> > /extract-cert
> > /x509_certificate_list
> > /x509_revocation_list
> > diff --git a/certs/Makefile b/certs/Makefile
> > index cb1a9da3fc58..a8d628fd5f7b 100644
> > --- a/certs/Makefile
> > +++ b/certs/Makefile
> > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> > - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > + cmd_check_and_copy_blacklist_hash_list = \
> > + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > -
> > -targets += blacklist_hashes_checked
> > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > + $(call if_changed,check_and_copy_blacklist_hash_list)
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > else
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > endif
> > +targets += blacklist_hash_list
> > quiet_cmd_extract_certs = CERT $@
> > cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > $(call if_changed,extract_certs)
> > -targets += x509_certificate_list blacklist_hashes_checked
> > +targets += x509_certificate_list
> > # If module signing is requested, say by allyesconfig, but a key has not been
> > # supplied, then one will need to be generated to make sure the build does not
> > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > index d5961aa3d338..86d66fe11348 100644
> > --- a/certs/blacklist_hashes.c
> > +++ b/certs/blacklist_hashes.c
> > @@ -2,6 +2,6 @@
> > #include "blacklist.h"
> > const char __initconst *const blacklist_hashes[] = {
> > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > +#include "blacklist_hash_list"
> > , NULL
> > };
I'll make a PR for 1/4 and 2/4 so that they get into 5.19.
BR, Jarkko
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-15 18:48 ` Jarkko Sakkinen
@ 2022-06-18 22:12 ` Masahiro Yamada
2022-06-26 6:16 ` Jarkko Sakkinen
0 siblings, 1 reply; 22+ messages in thread
From: Masahiro Yamada @ 2022-06-18 22:12 UTC (permalink / raw)
To: Jarkko Sakkinen
Cc: Mickaël Salaün, Linux Kbuild mailing list,
David Howells, David Woodhouse, keyrings,
Linux Kernel Mailing List, Eric Snowberg, Herbert Xu,
Tyler Hicks
On Thu, Jun 16, 2022 at 3:51 AM Jarkko Sakkinen <jarkko@kernel.org> wrote:
>
> On Mon, Jun 13, 2022 at 02:34:36PM +0200, Mickaël Salaün wrote:
> >
> >
> > On 11/06/2022 19:22, Masahiro Yamada wrote:
> > > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > > valid") was applied 8 months after the submission.
> > >
> > > In the meantime, the base code had been removed by commit b8c96a6b466c
> > > ("certs: simplify $(srctree)/ handling and remove config_filename
> > > macro").
> > >
> > > Fix the Makefile.
> > >
> > > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > > included from certs/blacklist_hashes.c and also works as a timestamp.
> > >
> > > Send error messages from check-blacklist-hashes.awk to stderr instead
> > > of stdout.
> > >
> > > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> >
> > Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> >
> > As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> > we can't really do something about that and it's OK.
> >
> > Thanks!
> >
> > > ---
> > >
> > > certs/.gitignore | 2 +-
> > > certs/Makefile | 20 ++++++++++----------
> > > certs/blacklist_hashes.c | 2 +-
> > > 3 files changed, 12 insertions(+), 12 deletions(-)
> > >
> > > diff --git a/certs/.gitignore b/certs/.gitignore
> > > index 56637aceaf81..cec5465f31c1 100644
> > > --- a/certs/.gitignore
> > > +++ b/certs/.gitignore
> > > @@ -1,5 +1,5 @@
> > > # SPDX-License-Identifier: GPL-2.0-only
> > > -/blacklist_hashes_checked
> > > +/blacklist_hash_list
> > > /extract-cert
> > > /x509_certificate_list
> > > /x509_revocation_list
> > > diff --git a/certs/Makefile b/certs/Makefile
> > > index cb1a9da3fc58..a8d628fd5f7b 100644
> > > --- a/certs/Makefile
> > > +++ b/certs/Makefile
> > > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > > obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > > ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > > -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> > > - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > > + cmd_check_and_copy_blacklist_hash_list = \
> > > + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > > + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > > -
> > > -targets += blacklist_hashes_checked
> > > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > > - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > > + $(call if_changed,check_and_copy_blacklist_hash_list)
> > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > > else
> > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > > endif
> > > +targets += blacklist_hash_list
> > > quiet_cmd_extract_certs = CERT $@
> > > cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> > > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > > $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > > $(call if_changed,extract_certs)
> > > -targets += x509_certificate_list blacklist_hashes_checked
> > > +targets += x509_certificate_list
> > > # If module signing is requested, say by allyesconfig, but a key has not been
> > > # supplied, then one will need to be generated to make sure the build does not
> > > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > > index d5961aa3d338..86d66fe11348 100644
> > > --- a/certs/blacklist_hashes.c
> > > +++ b/certs/blacklist_hashes.c
> > > @@ -2,6 +2,6 @@
> > > #include "blacklist.h"
> > > const char __initconst *const blacklist_hashes[] = {
> > > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > > +#include "blacklist_hash_list"
> > > , NULL
> > > };
>
> I'll make a PR for 1/4 and 2/4 so that they get into 5.19.
>
> BR, Jarkko
Thank you!
What shall we do for 3/4 and 4/4?
Do you have a plan to queue them up for the next MW?
Or, shall I apply them to my kbuild tree with your reivewed-by?
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-18 22:12 ` Masahiro Yamada
@ 2022-06-26 6:16 ` Jarkko Sakkinen
2022-06-27 1:26 ` Masahiro Yamada
0 siblings, 1 reply; 22+ messages in thread
From: Jarkko Sakkinen @ 2022-06-26 6:16 UTC (permalink / raw)
To: Masahiro Yamada
Cc: Mickaël Salaün, Linux Kbuild mailing list,
David Howells, David Woodhouse, keyrings,
Linux Kernel Mailing List, Eric Snowberg, Herbert Xu,
Tyler Hicks
On Sun, Jun 19, 2022 at 07:12:31AM +0900, Masahiro Yamada wrote:
> On Thu, Jun 16, 2022 at 3:51 AM Jarkko Sakkinen <jarkko@kernel.org> wrote:
> >
> > On Mon, Jun 13, 2022 at 02:34:36PM +0200, Mickaël Salaün wrote:
> > >
> > >
> > > On 11/06/2022 19:22, Masahiro Yamada wrote:
> > > > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > > > valid") was applied 8 months after the submission.
> > > >
> > > > In the meantime, the base code had been removed by commit b8c96a6b466c
> > > > ("certs: simplify $(srctree)/ handling and remove config_filename
> > > > macro").
> > > >
> > > > Fix the Makefile.
> > > >
> > > > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > > > included from certs/blacklist_hashes.c and also works as a timestamp.
> > > >
> > > > Send error messages from check-blacklist-hashes.awk to stderr instead
> > > > of stdout.
> > > >
> > > > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > > > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> > >
> > > Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> > >
> > > As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> > > we can't really do something about that and it's OK.
> > >
> > > Thanks!
> > >
> > > > ---
> > > >
> > > > certs/.gitignore | 2 +-
> > > > certs/Makefile | 20 ++++++++++----------
> > > > certs/blacklist_hashes.c | 2 +-
> > > > 3 files changed, 12 insertions(+), 12 deletions(-)
> > > >
> > > > diff --git a/certs/.gitignore b/certs/.gitignore
> > > > index 56637aceaf81..cec5465f31c1 100644
> > > > --- a/certs/.gitignore
> > > > +++ b/certs/.gitignore
> > > > @@ -1,5 +1,5 @@
> > > > # SPDX-License-Identifier: GPL-2.0-only
> > > > -/blacklist_hashes_checked
> > > > +/blacklist_hash_list
> > > > /extract-cert
> > > > /x509_certificate_list
> > > > /x509_revocation_list
> > > > diff --git a/certs/Makefile b/certs/Makefile
> > > > index cb1a9da3fc58..a8d628fd5f7b 100644
> > > > --- a/certs/Makefile
> > > > +++ b/certs/Makefile
> > > > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > > > obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > > > ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > > > -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> > > > - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > > > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > > > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > > > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > > > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > > > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > > > + cmd_check_and_copy_blacklist_hash_list = \
> > > > + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > > > + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > > > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > > > -
> > > > -targets += blacklist_hashes_checked
> > > > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > > > - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > > > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > > > + $(call if_changed,check_and_copy_blacklist_hash_list)
> > > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > > > else
> > > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > > > endif
> > > > +targets += blacklist_hash_list
> > > > quiet_cmd_extract_certs = CERT $@
> > > > cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> > > > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > > > $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > > > $(call if_changed,extract_certs)
> > > > -targets += x509_certificate_list blacklist_hashes_checked
> > > > +targets += x509_certificate_list
> > > > # If module signing is requested, say by allyesconfig, but a key has not been
> > > > # supplied, then one will need to be generated to make sure the build does not
> > > > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > > > index d5961aa3d338..86d66fe11348 100644
> > > > --- a/certs/blacklist_hashes.c
> > > > +++ b/certs/blacklist_hashes.c
> > > > @@ -2,6 +2,6 @@
> > > > #include "blacklist.h"
> > > > const char __initconst *const blacklist_hashes[] = {
> > > > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > > > +#include "blacklist_hash_list"
> > > > , NULL
> > > > };
> >
> > I'll make a PR for 1/4 and 2/4 so that they get into 5.19.
> >
> > BR, Jarkko
>
>
> Thank you!
>
> What shall we do for 3/4 and 4/4?
>
> Do you have a plan to queue them up for the next MW?
>
> Or, shall I apply them to my kbuild tree with your reivewed-by?
If possible, please do, thank you for taking the trouble.
BR, Jarkko
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-26 6:16 ` Jarkko Sakkinen
@ 2022-06-27 1:26 ` Masahiro Yamada
0 siblings, 0 replies; 22+ messages in thread
From: Masahiro Yamada @ 2022-06-27 1:26 UTC (permalink / raw)
To: Jarkko Sakkinen
Cc: Mickaël Salaün, Linux Kbuild mailing list,
David Howells, David Woodhouse, keyrings,
Linux Kernel Mailing List, Eric Snowberg, Herbert Xu,
Tyler Hicks
On Sun, Jun 26, 2022 at 3:16 PM Jarkko Sakkinen <jarkko@kernel.org> wrote:
>
> On Sun, Jun 19, 2022 at 07:12:31AM +0900, Masahiro Yamada wrote:
> > On Thu, Jun 16, 2022 at 3:51 AM Jarkko Sakkinen <jarkko@kernel.org> wrote:
> > >
> > > On Mon, Jun 13, 2022 at 02:34:36PM +0200, Mickaël Salaün wrote:
> > > >
> > > >
> > > > On 11/06/2022 19:22, Masahiro Yamada wrote:
> > > > > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > > > > valid") was applied 8 months after the submission.
> > > > >
> > > > > In the meantime, the base code had been removed by commit b8c96a6b466c
> > > > > ("certs: simplify $(srctree)/ handling and remove config_filename
> > > > > macro").
> > > > >
> > > > > Fix the Makefile.
> > > > >
> > > > > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > > > > included from certs/blacklist_hashes.c and also works as a timestamp.
> > > > >
> > > > > Send error messages from check-blacklist-hashes.awk to stderr instead
> > > > > of stdout.
> > > > >
> > > > > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > > > > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> > > >
> > > > Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> > > >
> > > > As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> > > > we can't really do something about that and it's OK.
> > > >
> > > > Thanks!
> > > >
> > > > > ---
> > > > >
> > > > > certs/.gitignore | 2 +-
> > > > > certs/Makefile | 20 ++++++++++----------
> > > > > certs/blacklist_hashes.c | 2 +-
> > > > > 3 files changed, 12 insertions(+), 12 deletions(-)
> > > > >
> > > > > diff --git a/certs/.gitignore b/certs/.gitignore
> > > > > index 56637aceaf81..cec5465f31c1 100644
> > > > > --- a/certs/.gitignore
> > > > > +++ b/certs/.gitignore
> > > > > @@ -1,5 +1,5 @@
> > > > > # SPDX-License-Identifier: GPL-2.0-only
> > > > > -/blacklist_hashes_checked
> > > > > +/blacklist_hash_list
> > > > > /extract-cert
> > > > > /x509_certificate_list
> > > > > /x509_revocation_list
> > > > > diff --git a/certs/Makefile b/certs/Makefile
> > > > > index cb1a9da3fc58..a8d628fd5f7b 100644
> > > > > --- a/certs/Makefile
> > > > > +++ b/certs/Makefile
> > > > > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > > > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > > > > obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > > > > ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > > > > -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> > > > > - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > > > > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > > > > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > > > > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > > > > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > > > > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > > > > + cmd_check_and_copy_blacklist_hash_list = \
> > > > > + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > > > > + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > > > > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > > > > -
> > > > > -targets += blacklist_hashes_checked
> > > > > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > > > > - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > > > > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > > > > + $(call if_changed,check_and_copy_blacklist_hash_list)
> > > > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > > > > else
> > > > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > > > > endif
> > > > > +targets += blacklist_hash_list
> > > > > quiet_cmd_extract_certs = CERT $@
> > > > > cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> > > > > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > > > > $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > > > > $(call if_changed,extract_certs)
> > > > > -targets += x509_certificate_list blacklist_hashes_checked
> > > > > +targets += x509_certificate_list
> > > > > # If module signing is requested, say by allyesconfig, but a key has not been
> > > > > # supplied, then one will need to be generated to make sure the build does not
> > > > > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > > > > index d5961aa3d338..86d66fe11348 100644
> > > > > --- a/certs/blacklist_hashes.c
> > > > > +++ b/certs/blacklist_hashes.c
> > > > > @@ -2,6 +2,6 @@
> > > > > #include "blacklist.h"
> > > > > const char __initconst *const blacklist_hashes[] = {
> > > > > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > > > > +#include "blacklist_hash_list"
> > > > > , NULL
> > > > > };
> > >
> > > I'll make a PR for 1/4 and 2/4 so that they get into 5.19.
> > >
> > > BR, Jarkko
> >
> >
> > Thank you!
> >
> > What shall we do for 3/4 and 4/4?
> >
> > Do you have a plan to queue them up for the next MW?
> >
> > Or, shall I apply them to my kbuild tree with your reivewed-by?
>
> If possible, please do, thank you for taking the trouble.
>
> BR, Jarkko
Now, 3/4 and 4/4 applied to linux-kbuild.
Thanks.
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build
2022-06-11 17:22 ` [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build Masahiro Yamada
2022-06-13 12:34 ` Mickaël Salaün
@ 2022-06-15 18:46 ` Jarkko Sakkinen
1 sibling, 0 replies; 22+ messages in thread
From: Jarkko Sakkinen @ 2022-06-15 18:46 UTC (permalink / raw)
To: Masahiro Yamada
Cc: linux-kbuild, David Howells,
Micka���l Sala���n,
David Woodhouse, keyrings, linux-kernel
On Sun, Jun 12, 2022 at 02:22:31AM +0900, Masahiro Yamada wrote:
> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> valid") was applied 8 months after the submission.
>
> In the meantime, the base code had been removed by commit b8c96a6b466c
> ("certs: simplify $(srctree)/ handling and remove config_filename
> macro").
>
> Fix the Makefile.
>
> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> included from certs/blacklist_hashes.c and also works as a timestamp.
>
> Send error messages from check-blacklist-hashes.awk to stderr instead
> of stdout.
>
> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---
>
> certs/.gitignore | 2 +-
> certs/Makefile | 20 ++++++++++----------
> certs/blacklist_hashes.c | 2 +-
> 3 files changed, 12 insertions(+), 12 deletions(-)
>
> diff --git a/certs/.gitignore b/certs/.gitignore
> index 56637aceaf81..cec5465f31c1 100644
> --- a/certs/.gitignore
> +++ b/certs/.gitignore
> @@ -1,5 +1,5 @@
> # SPDX-License-Identifier: GPL-2.0-only
> -/blacklist_hashes_checked
> +/blacklist_hash_list
> /extract-cert
> /x509_certificate_list
> /x509_revocation_list
> diff --git a/certs/Makefile b/certs/Makefile
> index cb1a9da3fc58..a8d628fd5f7b 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
>
> -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> +CFLAGS_blacklist_hashes.o := -I $(obj)
>
> -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> + cmd_check_and_copy_blacklist_hash_list = \
> + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>
> -CFLAGS_blacklist_hashes.o += -I$(srctree)
> -
> -targets += blacklist_hashes_checked
> -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> + $(call if_changed,check_and_copy_blacklist_hash_list)
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> else
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> endif
> +targets += blacklist_hash_list
>
> quiet_cmd_extract_certs = CERT $@
> cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> $(call if_changed,extract_certs)
>
> -targets += x509_certificate_list blacklist_hashes_checked
> +targets += x509_certificate_list
>
> # If module signing is requested, say by allyesconfig, but a key has not been
> # supplied, then one will need to be generated to make sure the build does not
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index d5961aa3d338..86d66fe11348 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -2,6 +2,6 @@
> #include "blacklist.h"
>
> const char __initconst *const blacklist_hashes[] = {
> -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> +#include "blacklist_hash_list"
> , NULL
> };
> --
> 2.32.0
>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/
2022-06-11 17:22 [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist Masahiro Yamada
2022-06-11 17:22 ` [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build Masahiro Yamada
@ 2022-06-11 17:22 ` Masahiro Yamada
2022-06-13 12:36 ` Mickaël Salaün
2022-06-15 18:46 ` Jarkko Sakkinen
2022-06-11 17:22 ` [PATCH 4/4] certs: unify blacklist_hashes.c and blacklist_nohashes.c Masahiro Yamada
` (2 subsequent siblings)
4 siblings, 2 replies; 22+ messages in thread
From: Masahiro Yamada @ 2022-06-11 17:22 UTC (permalink / raw)
To: linux-kbuild
Cc: David Howells, Jarkko Sakkinen,
Micka���l Sala���n,
Masahiro Yamada, David Woodhouse, keyrings, linux-kernel
This script is only used in certs/Makefile, so certs/ is a better
home for it.
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---
MAINTAINERS | 1 -
certs/Makefile | 2 +-
{scripts => certs}/check-blacklist-hashes.awk | 0
3 files changed, 1 insertion(+), 2 deletions(-)
rename {scripts => certs}/check-blacklist-hashes.awk (100%)
diff --git a/MAINTAINERS b/MAINTAINERS
index 1fc9ead83d2a..7c2a7c304824 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4627,7 +4627,6 @@ L: keyrings@vger.kernel.org
S: Maintained
F: Documentation/admin-guide/module-signing.rst
F: certs/
-F: scripts/check-blacklist-hashes.awk
F: scripts/sign-file.c
F: tools/certs/
diff --git a/certs/Makefile b/certs/Makefile
index a8d628fd5f7b..df7aaeafd19c 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
cmd_check_and_copy_blacklist_hash_list = \
- $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
+ $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
similarity index 100%
rename from scripts/check-blacklist-hashes.awk
rename to certs/check-blacklist-hashes.awk
--
2.32.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/
2022-06-11 17:22 ` [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/ Masahiro Yamada
@ 2022-06-13 12:36 ` Mickaël Salaün
2022-06-13 15:28 ` Masahiro Yamada
2022-06-15 18:46 ` Jarkko Sakkinen
1 sibling, 1 reply; 22+ messages in thread
From: Mickaël Salaün @ 2022-06-13 12:36 UTC (permalink / raw)
To: Masahiro Yamada, linux-kbuild
Cc: David Howells, Jarkko Sakkinen, David Woodhouse, keyrings,
linux-kernel, Eric Snowberg, Herbert Xu, Tyler Hicks
On 11/06/2022 19:22, Masahiro Yamada wrote:
> This script is only used in certs/Makefile, so certs/ is a better
> home for it.
>
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---
>
> MAINTAINERS | 1 -
> certs/Makefile | 2 +-
> {scripts => certs}/check-blacklist-hashes.awk | 0
> 3 files changed, 1 insertion(+), 2 deletions(-)
> rename {scripts => certs}/check-blacklist-hashes.awk (100%)
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 1fc9ead83d2a..7c2a7c304824 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -4627,7 +4627,6 @@ L: keyrings@vger.kernel.org
> S: Maintained
> F: Documentation/admin-guide/module-signing.rst
> F: certs/
> -F: scripts/check-blacklist-hashes.awk > F: scripts/sign-file.c
> F: tools/certs/
>
> diff --git a/certs/Makefile b/certs/Makefile
> index a8d628fd5f7b..df7aaeafd19c 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
>
> quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> cmd_check_and_copy_blacklist_hash_list = \
> - $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> + $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>
> $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
> similarity index 100%
> rename from scripts/check-blacklist-hashes.awk
> rename to certs/check-blacklist-hashes.awk
It looks more appropriate and consistent to me to keep it in scripts/,
close to other cert scripts. Is there some precedent to move such script?
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/
2022-06-13 12:36 ` Mickaël Salaün
@ 2022-06-13 15:28 ` Masahiro Yamada
2022-06-13 18:51 ` Mickaël Salaün
0 siblings, 1 reply; 22+ messages in thread
From: Masahiro Yamada @ 2022-06-13 15:28 UTC (permalink / raw)
To: Mickaël Salaün
Cc: Linux Kbuild mailing list, David Howells, Jarkko Sakkinen,
David Woodhouse, keyrings, Linux Kernel Mailing List,
Eric Snowberg, Herbert Xu, Tyler Hicks
On Mon, Jun 13, 2022 at 9:36 PM Mickaël Salaün <mic@digikod.net> wrote:
>
>
>
> On 11/06/2022 19:22, Masahiro Yamada wrote:
> > This script is only used in certs/Makefile, so certs/ is a better
> > home for it.
> >
> > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> > ---
> >
> > MAINTAINERS | 1 -
> > certs/Makefile | 2 +-
> > {scripts => certs}/check-blacklist-hashes.awk | 0
> > 3 files changed, 1 insertion(+), 2 deletions(-)
> > rename {scripts => certs}/check-blacklist-hashes.awk (100%)
> >
> > diff --git a/MAINTAINERS b/MAINTAINERS
> > index 1fc9ead83d2a..7c2a7c304824 100644
> > --- a/MAINTAINERS
> > +++ b/MAINTAINERS
> > @@ -4627,7 +4627,6 @@ L: keyrings@vger.kernel.org
> > S: Maintained
> > F: Documentation/admin-guide/module-signing.rst
> > F: certs/
> > -F: scripts/check-blacklist-hashes.awk > F: scripts/sign-file.c
> > F: tools/certs/
> >
> > diff --git a/certs/Makefile b/certs/Makefile
> > index a8d628fd5f7b..df7aaeafd19c 100644
> > --- a/certs/Makefile
> > +++ b/certs/Makefile
> > @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
> >
> > quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > cmd_check_and_copy_blacklist_hash_list = \
> > - $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > + $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> >
> > $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
> > similarity index 100%
> > rename from scripts/check-blacklist-hashes.awk
> > rename to certs/check-blacklist-hashes.awk
>
> It looks more appropriate and consistent to me to keep it in scripts/,
> close to other cert scripts. Is there some precedent to move such script?
I always did that. For example,
f6f57a46435d7253a52a1a07a58183678ad266a0
78a20a012ecea857e438b1f9e8091acb290bd0f5
28ba53c07638f31b153e3a32672a6124d0ff2a97
4484aa800ac588a1fe2175cd53076c21067f44b4
340a02535ee785c64c62a9c45706597a0139e972
Tools can stay in scripts/ if and only if:
- it is used globally during kernel builds
- it is still needed after the kernel builds.
"make clean" removes most of the build artifacts
but keeps ones under scripts/.
scripts/insert-sys-cert is apparently unneeded for building the kernel.
If the intended use is to manipulate vmlinux later,
that is the legitimate reason to stay in scripts/.
(but even better place might be tools/)
certs/signing_key.pem is needed even after kernel builds.
So, it should have been kept under scripts/ instead of certs/.
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/
2022-06-13 15:28 ` Masahiro Yamada
@ 2022-06-13 18:51 ` Mickaël Salaün
0 siblings, 0 replies; 22+ messages in thread
From: Mickaël Salaün @ 2022-06-13 18:51 UTC (permalink / raw)
To: Masahiro Yamada
Cc: Linux Kbuild mailing list, David Howells, Jarkko Sakkinen,
David Woodhouse, keyrings, Linux Kernel Mailing List,
Eric Snowberg, Herbert Xu, Tyler Hicks
On 13/06/2022 17:28, Masahiro Yamada wrote:
> On Mon, Jun 13, 2022 at 9:36 PM Mickaël Salaün <mic@digikod.net> wrote:
>>
>>
>>
>> On 11/06/2022 19:22, Masahiro Yamada wrote:
>>> This script is only used in certs/Makefile, so certs/ is a better
>>> home for it.
>>>
>>> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
>>> ---
>>>
>>> MAINTAINERS | 1 -
>>> certs/Makefile | 2 +-
>>> {scripts => certs}/check-blacklist-hashes.awk | 0
>>> 3 files changed, 1 insertion(+), 2 deletions(-)
>>> rename {scripts => certs}/check-blacklist-hashes.awk (100%)
>>>
>>> diff --git a/MAINTAINERS b/MAINTAINERS
>>> index 1fc9ead83d2a..7c2a7c304824 100644
>>> --- a/MAINTAINERS
>>> +++ b/MAINTAINERS
>>> @@ -4627,7 +4627,6 @@ L: keyrings@vger.kernel.org
>>> S: Maintained
>>> F: Documentation/admin-guide/module-signing.rst
>>> F: certs/
>>> -F: scripts/check-blacklist-hashes.awk > F: scripts/sign-file.c
>>> F: tools/certs/
>>>
>>> diff --git a/certs/Makefile b/certs/Makefile
>>> index a8d628fd5f7b..df7aaeafd19c 100644
>>> --- a/certs/Makefile
>>> +++ b/certs/Makefile
>>> @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
>>>
>>> quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
>>> cmd_check_and_copy_blacklist_hash_list = \
>>> - $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>>> + $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>>> cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>>>
>>> $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
>>> diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
>>> similarity index 100%
>>> rename from scripts/check-blacklist-hashes.awk
>>> rename to certs/check-blacklist-hashes.awk
>>
>> It looks more appropriate and consistent to me to keep it in scripts/,
>> close to other cert scripts. Is there some precedent to move such script?
>
>
> I always did that. For example,
>
> f6f57a46435d7253a52a1a07a58183678ad266a0
> 78a20a012ecea857e438b1f9e8091acb290bd0f5
> 28ba53c07638f31b153e3a32672a6124d0ff2a97
> 4484aa800ac588a1fe2175cd53076c21067f44b4
> 340a02535ee785c64c62a9c45706597a0139e972
>
>
> Tools can stay in scripts/ if and only if:
>
> - it is used globally during kernel builds
>
> - it is still needed after the kernel builds.
> "make clean" removes most of the build artifacts
> but keeps ones under scripts/.
>
OK, it would be nice to have these rules in the documentation (didn't
find them).
Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
>
>
> scripts/insert-sys-cert is apparently unneeded for building the kernel.
> If the intended use is to manipulate vmlinux later,
> that is the legitimate reason to stay in scripts/.
> (but even better place might be tools/)
>
>
> certs/signing_key.pem is needed even after kernel builds.
> So, it should have been kept under scripts/ instead of certs/.
>
>
>
>
>
> --
> Best Regards
> Masahiro Yamada
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/
2022-06-11 17:22 ` [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/ Masahiro Yamada
2022-06-13 12:36 ` Mickaël Salaün
@ 2022-06-15 18:46 ` Jarkko Sakkinen
1 sibling, 0 replies; 22+ messages in thread
From: Jarkko Sakkinen @ 2022-06-15 18:46 UTC (permalink / raw)
To: Masahiro Yamada
Cc: linux-kbuild, David Howells,
Micka���l Sala���n,
David Woodhouse, keyrings, linux-kernel
On Sun, Jun 12, 2022 at 02:22:32AM +0900, Masahiro Yamada wrote:
> This script is only used in certs/Makefile, so certs/ is a better
> home for it.
>
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---
>
> MAINTAINERS | 1 -
> certs/Makefile | 2 +-
> {scripts => certs}/check-blacklist-hashes.awk | 0
> 3 files changed, 1 insertion(+), 2 deletions(-)
> rename {scripts => certs}/check-blacklist-hashes.awk (100%)
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 1fc9ead83d2a..7c2a7c304824 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -4627,7 +4627,6 @@ L: keyrings@vger.kernel.org
> S: Maintained
> F: Documentation/admin-guide/module-signing.rst
> F: certs/
> -F: scripts/check-blacklist-hashes.awk
> F: scripts/sign-file.c
> F: tools/certs/
>
> diff --git a/certs/Makefile b/certs/Makefile
> index a8d628fd5f7b..df7aaeafd19c 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
>
> quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> cmd_check_and_copy_blacklist_hash_list = \
> - $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> + $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>
> $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
> similarity index 100%
> rename from scripts/check-blacklist-hashes.awk
> rename to certs/check-blacklist-hashes.awk
> --
> 2.32.0
>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH 4/4] certs: unify blacklist_hashes.c and blacklist_nohashes.c
2022-06-11 17:22 [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist Masahiro Yamada
2022-06-11 17:22 ` [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build Masahiro Yamada
2022-06-11 17:22 ` [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/ Masahiro Yamada
@ 2022-06-11 17:22 ` Masahiro Yamada
2022-06-13 12:37 ` Mickaël Salaün
2022-06-15 18:47 ` Jarkko Sakkinen
2022-06-13 12:20 ` [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist Mickaël Salaün
2022-06-15 18:46 ` Jarkko Sakkinen
4 siblings, 2 replies; 22+ messages in thread
From: Masahiro Yamada @ 2022-06-11 17:22 UTC (permalink / raw)
To: linux-kbuild
Cc: David Howells, Jarkko Sakkinen,
Micka���l Sala���n,
Masahiro Yamada, David Woodhouse, keyrings, linux-kernel
These two files are very similar. Unify them.
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---
certs/Makefile | 12 +++++-------
certs/blacklist_hashes.c | 1 -
certs/blacklist_nohashes.c | 6 ------
3 files changed, 5 insertions(+), 14 deletions(-)
delete mode 100644 certs/blacklist_nohashes.c
diff --git a/certs/Makefile b/certs/Makefile
index df7aaeafd19c..7068d45db807 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -4,24 +4,22 @@
#
obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o common.o
-obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
+obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o blacklist_hashes.o
obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
-ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
CFLAGS_blacklist_hashes.o := -I $(obj)
quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
cmd_check_and_copy_blacklist_hash_list = \
+ $(if $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST), \
$(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
- cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
+ { cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST); echo $(comma) NULL; } > $@, \
+ echo NULL > $@)
$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
$(call if_changed,check_and_copy_blacklist_hash_list)
-obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
-else
-obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
-endif
+
targets += blacklist_hash_list
quiet_cmd_extract_certs = CERT $@
diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
index 86d66fe11348..0c5476abebd9 100644
--- a/certs/blacklist_hashes.c
+++ b/certs/blacklist_hashes.c
@@ -3,5 +3,4 @@
const char __initconst *const blacklist_hashes[] = {
#include "blacklist_hash_list"
- , NULL
};
diff --git a/certs/blacklist_nohashes.c b/certs/blacklist_nohashes.c
deleted file mode 100644
index 753b703ef0ef..000000000000
--- a/certs/blacklist_nohashes.c
+++ /dev/null
@@ -1,6 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-#include "blacklist.h"
-
-const char __initconst *const blacklist_hashes[] = {
- NULL
-};
--
2.32.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [PATCH 4/4] certs: unify blacklist_hashes.c and blacklist_nohashes.c
2022-06-11 17:22 ` [PATCH 4/4] certs: unify blacklist_hashes.c and blacklist_nohashes.c Masahiro Yamada
@ 2022-06-13 12:37 ` Mickaël Salaün
2022-06-15 18:47 ` Jarkko Sakkinen
1 sibling, 0 replies; 22+ messages in thread
From: Mickaël Salaün @ 2022-06-13 12:37 UTC (permalink / raw)
To: Masahiro Yamada, linux-kbuild
Cc: David Howells, Jarkko Sakkinen, David Woodhouse, keyrings,
linux-kernel, Eric Snowberg, Herbert Xu, Tyler Hicks
On 11/06/2022 19:22, Masahiro Yamada wrote:
> These two files are very similar. Unify them.
>
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> ---
>
> certs/Makefile | 12 +++++-------
> certs/blacklist_hashes.c | 1 -
> certs/blacklist_nohashes.c | 6 ------
> 3 files changed, 5 insertions(+), 14 deletions(-)
> delete mode 100644 certs/blacklist_nohashes.c
>
> diff --git a/certs/Makefile b/certs/Makefile
> index df7aaeafd19c..7068d45db807 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -4,24 +4,22 @@
> #
>
> obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o common.o
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> +obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o blacklist_hashes.o
> obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> -ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
>
> $(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> CFLAGS_blacklist_hashes.o := -I $(obj)
>
> quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> cmd_check_and_copy_blacklist_hash_list = \
> + $(if $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST), \
> $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> - cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> + { cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST); echo $(comma) NULL; } > $@, \
> + echo NULL > $@)
>
> $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> $(call if_changed,check_and_copy_blacklist_hash_list)
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> -else
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> -endif
> +
> targets += blacklist_hash_list
>
> quiet_cmd_extract_certs = CERT $@
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index 86d66fe11348..0c5476abebd9 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -3,5 +3,4 @@
>
> const char __initconst *const blacklist_hashes[] = {
> #include "blacklist_hash_list"
> - , NULL
> };
> diff --git a/certs/blacklist_nohashes.c b/certs/blacklist_nohashes.c
> deleted file mode 100644
> index 753b703ef0ef..000000000000
> --- a/certs/blacklist_nohashes.c
> +++ /dev/null
> @@ -1,6 +0,0 @@
> -// SPDX-License-Identifier: GPL-2.0
> -#include "blacklist.h"
> -
> -const char __initconst *const blacklist_hashes[] = {
> - NULL
> -};
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 4/4] certs: unify blacklist_hashes.c and blacklist_nohashes.c
2022-06-11 17:22 ` [PATCH 4/4] certs: unify blacklist_hashes.c and blacklist_nohashes.c Masahiro Yamada
2022-06-13 12:37 ` Mickaël Salaün
@ 2022-06-15 18:47 ` Jarkko Sakkinen
1 sibling, 0 replies; 22+ messages in thread
From: Jarkko Sakkinen @ 2022-06-15 18:47 UTC (permalink / raw)
To: Masahiro Yamada
Cc: linux-kbuild, David Howells,
Micka���l Sala���n,
David Woodhouse, keyrings, linux-kernel
On Sun, Jun 12, 2022 at 02:22:33AM +0900, Masahiro Yamada wrote:
> These two files are very similar. Unify them.
>
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---
>
> certs/Makefile | 12 +++++-------
> certs/blacklist_hashes.c | 1 -
> certs/blacklist_nohashes.c | 6 ------
> 3 files changed, 5 insertions(+), 14 deletions(-)
> delete mode 100644 certs/blacklist_nohashes.c
>
> diff --git a/certs/Makefile b/certs/Makefile
> index df7aaeafd19c..7068d45db807 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -4,24 +4,22 @@
> #
>
> obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o common.o
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> +obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o blacklist_hashes.o
> obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> -ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
>
> $(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> CFLAGS_blacklist_hashes.o := -I $(obj)
>
> quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> cmd_check_and_copy_blacklist_hash_list = \
> + $(if $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST), \
> $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> - cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> + { cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST); echo $(comma) NULL; } > $@, \
> + echo NULL > $@)
>
> $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> $(call if_changed,check_and_copy_blacklist_hash_list)
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> -else
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> -endif
> +
> targets += blacklist_hash_list
>
> quiet_cmd_extract_certs = CERT $@
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index 86d66fe11348..0c5476abebd9 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -3,5 +3,4 @@
>
> const char __initconst *const blacklist_hashes[] = {
> #include "blacklist_hash_list"
> - , NULL
> };
> diff --git a/certs/blacklist_nohashes.c b/certs/blacklist_nohashes.c
> deleted file mode 100644
> index 753b703ef0ef..000000000000
> --- a/certs/blacklist_nohashes.c
> +++ /dev/null
> @@ -1,6 +0,0 @@
> -// SPDX-License-Identifier: GPL-2.0
> -#include "blacklist.h"
> -
> -const char __initconst *const blacklist_hashes[] = {
> - NULL
> -};
> --
> 2.32.0
>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist
2022-06-11 17:22 [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist Masahiro Yamada
` (2 preceding siblings ...)
2022-06-11 17:22 ` [PATCH 4/4] certs: unify blacklist_hashes.c and blacklist_nohashes.c Masahiro Yamada
@ 2022-06-13 12:20 ` Mickaël Salaün
2022-06-15 18:46 ` Jarkko Sakkinen
4 siblings, 0 replies; 22+ messages in thread
From: Mickaël Salaün @ 2022-06-13 12:20 UTC (permalink / raw)
To: Masahiro Yamada, linux-kbuild
Cc: David Howells, Jarkko Sakkinen, David Woodhouse, keyrings,
linux-kernel, Eric Snowberg, Herbert Xu, Tyler Hicks
On 11/06/2022 19:22, Masahiro Yamada wrote:
> This file fails to compile as follows:
>
> CC certs/blacklist_hashes.o
> certs/blacklist_hashes.c:4:1: error: ignoring attribute ‘section (".init.data")’ because it conflicts with previous ‘section (".init.rodata")’ [-Werror=attributes]
> 4 | const char __initdata *const blacklist_hashes[] = {
> | ^~~~~
> In file included from certs/blacklist_hashes.c:2:
> certs/blacklist.h:5:38: note: previous declaration here
> 5 | extern const char __initconst *const blacklist_hashes[];
> | ^~~~~~~~~~~~~~~~
>
> Apply the same fix as commit 2be04df5668d ("certs/blacklist_nohashes.c:
> fix const confusion in certs blacklist").
>
> Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring")
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> ---
>
> certs/blacklist_hashes.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index 344892337be0..d5961aa3d338 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -1,7 +1,7 @@
> // SPDX-License-Identifier: GPL-2.0
> #include "blacklist.h"
>
> -const char __initdata *const blacklist_hashes[] = {
> +const char __initconst *const blacklist_hashes[] = {
> #include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> , NULL
> };
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist
2022-06-11 17:22 [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist Masahiro Yamada
` (3 preceding siblings ...)
2022-06-13 12:20 ` [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist Mickaël Salaün
@ 2022-06-15 18:46 ` Jarkko Sakkinen
4 siblings, 0 replies; 22+ messages in thread
From: Jarkko Sakkinen @ 2022-06-15 18:46 UTC (permalink / raw)
To: Masahiro Yamada
Cc: linux-kbuild, David Howells,
Micka���l Sala���n,
David Woodhouse, keyrings, linux-kernel
On Sun, Jun 12, 2022 at 02:22:30AM +0900, Masahiro Yamada wrote:
> This file fails to compile as follows:
>
> CC certs/blacklist_hashes.o
> certs/blacklist_hashes.c:4:1: error: ignoring attribute ‘section (".init.data")’ because it conflicts with previous ‘section (".init.rodata")’ [-Werror=attributes]
> 4 | const char __initdata *const blacklist_hashes[] = {
> | ^~~~~
> In file included from certs/blacklist_hashes.c:2:
> certs/blacklist.h:5:38: note: previous declaration here
> 5 | extern const char __initconst *const blacklist_hashes[];
> | ^~~~~~~~~~~~~~~~
>
> Apply the same fix as commit 2be04df5668d ("certs/blacklist_nohashes.c:
> fix const confusion in certs blacklist").
>
> Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring")
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---
>
> certs/blacklist_hashes.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index 344892337be0..d5961aa3d338 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -1,7 +1,7 @@
> // SPDX-License-Identifier: GPL-2.0
> #include "blacklist.h"
>
> -const char __initdata *const blacklist_hashes[] = {
> +const char __initconst *const blacklist_hashes[] = {
> #include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> , NULL
> };
> --
> 2.32.0
>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
^ permalink raw reply [flat|nested] 22+ messages in thread