* [PATCH 1/5] certs: remove meaningless $(error ...) in certs/Makefile
2021-11-05 3:59 [PATCH 0/5] certs: various cleanups of certs/Makefile Masahiro Yamada
@ 2021-11-05 3:59 ` Masahiro Yamada
2021-11-05 3:59 ` [PATCH 2/5] certs: check-in the default x509 config file Masahiro Yamada
` (4 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Masahiro Yamada @ 2021-11-05 3:59 UTC (permalink / raw)
To: Jarkko Sakkinen, David Howells, David Woodhouse, keyrings
Cc: Arnd Bergmann, Masahiro Yamada, linux-kernel
CONFIG_MODULE_SIG_HASH is defined by init/Kconfig. This $(error ...) is
never reachable. (If it is, you need to fix the bug.)
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---
certs/Makefile | 3 ---
1 file changed, 3 deletions(-)
diff --git a/certs/Makefile b/certs/Makefile
index 279433783b10..db1fd2f4b950 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -50,9 +50,6 @@ ifdef SIGN_KEY
# fail and that the kernel may be used afterwards.
#
###############################################################################
-ifndef CONFIG_MODULE_SIG_HASH
-$(error Could not determine digest type to use from kernel config)
-endif
redirect_openssl = 2>&1
quiet_redirect_openssl = 2>&1
--
2.30.2
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH 2/5] certs: check-in the default x509 config file
2021-11-05 3:59 [PATCH 0/5] certs: various cleanups of certs/Makefile Masahiro Yamada
2021-11-05 3:59 ` [PATCH 1/5] certs: remove meaningless $(error ...) in certs/Makefile Masahiro Yamada
@ 2021-11-05 3:59 ` Masahiro Yamada
2021-11-05 3:59 ` [PATCH 3/5] certs: remove noisy messages while generating the signing key Masahiro Yamada
` (3 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Masahiro Yamada @ 2021-11-05 3:59 UTC (permalink / raw)
To: Jarkko Sakkinen, David Howells, David Woodhouse, keyrings
Cc: Arnd Bergmann, Masahiro Yamada, linux-kernel
When x509.genkey is created, it prints a log:
Generating X.509 key generation config
..., which is not the ordinary Kbuild log style.
Check-in the default config as certs/default_x509.genkey to make it
readable, and copy it to certs/x509.genkey if it is not present.
The log is shown in the Kbuild style.
COPY certs/x509.genkey
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---
certs/Makefile | 24 ++++++------------------
certs/default_x509.genkey | 17 +++++++++++++++++
2 files changed, 23 insertions(+), 18 deletions(-)
create mode 100644 certs/default_x509.genkey
diff --git a/certs/Makefile b/certs/Makefile
index db1fd2f4b950..fc94a260e3f3 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -98,25 +98,13 @@ $(obj)/signing_key.pem: $(obj)/x509.genkey
@$(kecho) "### Key pair generated."
@$(kecho) "###"
+quiet_cmd_copy_x509_config = COPY $@
+ cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@
+
+# You can provide your own config file. If not present, copy the default one.
$(obj)/x509.genkey:
- @$(kecho) Generating X.509 key generation config
- @echo >$@ "[ req ]"
- @echo >>$@ "default_bits = 4096"
- @echo >>$@ "distinguished_name = req_distinguished_name"
- @echo >>$@ "prompt = no"
- @echo >>$@ "string_mask = utf8only"
- @echo >>$@ "x509_extensions = myexts"
- @echo >>$@
- @echo >>$@ "[ req_distinguished_name ]"
- @echo >>$@ "#O = Unspecified company"
- @echo >>$@ "CN = Build time autogenerated kernel key"
- @echo >>$@ "#emailAddress = unspecified.user@unspecified.company"
- @echo >>$@
- @echo >>$@ "[ myexts ]"
- @echo >>$@ "basicConstraints=critical,CA:FALSE"
- @echo >>$@ "keyUsage=digitalSignature"
- @echo >>$@ "subjectKeyIdentifier=hash"
- @echo >>$@ "authorityKeyIdentifier=keyid"
+ $(call cmd,copy_x509_config)
+
endif # CONFIG_MODULE_SIG_KEY
$(eval $(call config_filename,MODULE_SIG_KEY))
diff --git a/certs/default_x509.genkey b/certs/default_x509.genkey
new file mode 100644
index 000000000000..d4c6628cb8e5
--- /dev/null
+++ b/certs/default_x509.genkey
@@ -0,0 +1,17 @@
+[ req ]
+default_bits = 4096
+distinguished_name = req_distinguished_name
+prompt = no
+string_mask = utf8only
+x509_extensions = myexts
+
+[ req_distinguished_name ]
+#O = Unspecified company
+CN = Build time autogenerated kernel key
+#emailAddress = unspecified.user@unspecified.company
+
+[ myexts ]
+basicConstraints=critical,CA:FALSE
+keyUsage=digitalSignature
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid
--
2.30.2
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH 3/5] certs: remove noisy messages while generating the signing key
2021-11-05 3:59 [PATCH 0/5] certs: various cleanups of certs/Makefile Masahiro Yamada
2021-11-05 3:59 ` [PATCH 1/5] certs: remove meaningless $(error ...) in certs/Makefile Masahiro Yamada
2021-11-05 3:59 ` [PATCH 2/5] certs: check-in the default x509 config file Masahiro Yamada
@ 2021-11-05 3:59 ` Masahiro Yamada
2021-11-05 7:33 ` Arnd Bergmann
2021-11-05 3:59 ` [PATCH 4/5] certs: use 'cmd' to hide openssl output in silent builds more simply Masahiro Yamada
` (2 subsequent siblings)
5 siblings, 1 reply; 9+ messages in thread
From: Masahiro Yamada @ 2021-11-05 3:59 UTC (permalink / raw)
To: Jarkko Sakkinen, David Howells, David Woodhouse, keyrings
Cc: Arnd Bergmann, Masahiro Yamada, linux-kernel
When you run Kbuild with the parallel option -j, the messages from this
rule and others are interleaved, like follows:
###
CC arch/x86/mm/pat/set_memory.o
### Now generating an X.509 key pair to be used for signing modules.
###
### If this takes a long time, you might wish to run rngd in the
### background to keep the supply of entropy topped up. It
CC arch/x86/events/intel/bts.o
HDRTEST usr/include/linux/qnx4_fs.h
CC arch/x86/events/zhaoxin/core.o
### needs to be run as root, and uses a hardware random
### number generator if one is available.
AR init/built-in.a
###
On modern machines, it does not take a long time to generate the key.
Remove the ugly log messages.
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---
certs/Makefile | 11 -----------
1 file changed, 11 deletions(-)
diff --git a/certs/Makefile b/certs/Makefile
index fc94a260e3f3..a8c9abceef00 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -80,23 +80,12 @@ endif
endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA
$(obj)/signing_key.pem: $(obj)/x509.genkey
- @$(kecho) "###"
- @$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
- @$(kecho) "###"
- @$(kecho) "### If this takes a long time, you might wish to run rngd in the"
- @$(kecho) "### background to keep the supply of entropy topped up. It"
- @$(kecho) "### needs to be run as root, and uses a hardware random"
- @$(kecho) "### number generator if one is available."
- @$(kecho) "###"
$(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
-batch -x509 -config $(obj)/x509.genkey \
-outform PEM -out $(obj)/signing_key.pem \
-keyout $(obj)/signing_key.pem \
$(keytype_openssl) \
$($(quiet)redirect_openssl)
- @$(kecho) "###"
- @$(kecho) "### Key pair generated."
- @$(kecho) "###"
quiet_cmd_copy_x509_config = COPY $@
cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@
--
2.30.2
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH 3/5] certs: remove noisy messages while generating the signing key
2021-11-05 3:59 ` [PATCH 3/5] certs: remove noisy messages while generating the signing key Masahiro Yamada
@ 2021-11-05 7:33 ` Arnd Bergmann
2021-11-05 7:55 ` Masahiro Yamada
0 siblings, 1 reply; 9+ messages in thread
From: Arnd Bergmann @ 2021-11-05 7:33 UTC (permalink / raw)
To: Masahiro Yamada
Cc: Jarkko Sakkinen, David Howells, David Woodhouse, keyrings,
Arnd Bergmann, Linux Kernel Mailing List
On Fri, Nov 5, 2021 at 4:59 AM Masahiro Yamada <masahiroy@kernel.org> wrote:
>
> When you run Kbuild with the parallel option -j, the messages from this
> rule and others are interleaved, like follows:
>
> ###
> CC arch/x86/mm/pat/set_memory.o
> ### Now generating an X.509 key pair to be used for signing modules.
> ###
> ### If this takes a long time, you might wish to run rngd in the
> ### background to keep the supply of entropy topped up. It
> CC arch/x86/events/intel/bts.o
> HDRTEST usr/include/linux/qnx4_fs.h
> CC arch/x86/events/zhaoxin/core.o
> ### needs to be run as root, and uses a hardware random
> ### number generator if one is available.
> AR init/built-in.a
> ###
>
> On modern machines, it does not take a long time to generate the key.
>
> Remove the ugly log messages.
I have no real objection to this, but I would still point out that
the warning message may still be helpful for those building
in a virtual machine or some other environment without a hwrng,
and that most people wouldn't see the message anway if they
built with 'make -s', at least after my 5d06ee20b662 ("modsign:
hide openssl output in silent builds").
I wonder if it would be time to change the default output to
be more quiet, by degrading it one level, like
old new
only warnings make -s make
CC file.o make make V=1
full cmdline make V=1 make V=2
This would take some time to adjust to, but it does sound like
a more reasonable default. Does anyone still build without -s
in practice?
Arnd
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH 3/5] certs: remove noisy messages while generating the signing key
2021-11-05 7:33 ` Arnd Bergmann
@ 2021-11-05 7:55 ` Masahiro Yamada
0 siblings, 0 replies; 9+ messages in thread
From: Masahiro Yamada @ 2021-11-05 7:55 UTC (permalink / raw)
To: Arnd Bergmann
Cc: Jarkko Sakkinen, David Howells, David Woodhouse, keyrings,
Linux Kernel Mailing List
On Fri, Nov 5, 2021 at 4:34 PM Arnd Bergmann <arnd@arndb.de> wrote:
>
> On Fri, Nov 5, 2021 at 4:59 AM Masahiro Yamada <masahiroy@kernel.org> wrote:
> >
> > When you run Kbuild with the parallel option -j, the messages from this
> > rule and others are interleaved, like follows:
> >
> > ###
> > CC arch/x86/mm/pat/set_memory.o
> > ### Now generating an X.509 key pair to be used for signing modules.
> > ###
> > ### If this takes a long time, you might wish to run rngd in the
> > ### background to keep the supply of entropy topped up. It
> > CC arch/x86/events/intel/bts.o
> > HDRTEST usr/include/linux/qnx4_fs.h
> > CC arch/x86/events/zhaoxin/core.o
> > ### needs to be run as root, and uses a hardware random
> > ### number generator if one is available.
> > AR init/built-in.a
> > ###
> >
> > On modern machines, it does not take a long time to generate the key.
> >
> > Remove the ugly log messages.
>
> I have no real objection to this, but I would still point out that
> the warning message may still be helpful for those building
> in a virtual machine or some other environment without a hwrng,
> and that most people wouldn't see the message anway if they
> built with 'make -s', at least after my 5d06ee20b662 ("modsign:
> hide openssl output in silent builds").
>
> I wonder if it would be time to change the default output to
> be more quiet, by degrading it one level, like
>
> old new
> only warnings make -s make
> CC file.o make make V=1
> full cmdline make V=1 make V=2
>
> This would take some time to adjust to, but it does sound like
> a more reasonable default. Does anyone still build without -s
> in practice?
Yes, me.
I usually build normally (CC file.o log style).
I am opposed to making silent builds default.
People would be upset if they do 'make' to
see nothing in the terminal.
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH 4/5] certs: use 'cmd' to hide openssl output in silent builds more simply
2021-11-05 3:59 [PATCH 0/5] certs: various cleanups of certs/Makefile Masahiro Yamada
` (2 preceding siblings ...)
2021-11-05 3:59 ` [PATCH 3/5] certs: remove noisy messages while generating the signing key Masahiro Yamada
@ 2021-11-05 3:59 ` Masahiro Yamada
2021-11-05 3:59 ` [PATCH 5/5] certs: use if_changed to re-generate the key when the key type is changed Masahiro Yamada
2021-12-11 18:42 ` [PATCH 0/5] certs: various cleanups of certs/Makefile Masahiro Yamada
5 siblings, 0 replies; 9+ messages in thread
From: Masahiro Yamada @ 2021-11-05 3:59 UTC (permalink / raw)
To: Jarkko Sakkinen, David Howells, David Woodhouse, keyrings
Cc: Arnd Bergmann, Masahiro Yamada, linux-kernel
Commit 5d06ee20b662 ("modsign: hide openssl output in silent builds")
silenced the key generation log from openssl in silent builds.
Since commit 174a1dcc9642 ("kbuild: sink stdout from cmd for silent
build"), the 'cmd' macro can handle it in a cleaner way.
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---
certs/Makefile | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/certs/Makefile b/certs/Makefile
index a8c9abceef00..fdf206022113 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -51,9 +51,6 @@ ifdef SIGN_KEY
#
###############################################################################
-redirect_openssl = 2>&1
-quiet_redirect_openssl = 2>&1
-silent_redirect_openssl = 2>/dev/null
openssl_available = $(shell openssl help 2>/dev/null && echo yes)
# We do it this way rather than having a boolean option for enabling an
@@ -79,13 +76,16 @@ $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.p
endif
endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA
-$(obj)/signing_key.pem: $(obj)/x509.genkey
- $(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
+quiet_cmd_gen_key = GENKEY $@
+ cmd_gen_key = openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
-batch -x509 -config $(obj)/x509.genkey \
-outform PEM -out $(obj)/signing_key.pem \
-keyout $(obj)/signing_key.pem \
$(keytype_openssl) \
- $($(quiet)redirect_openssl)
+ 2>&1
+
+$(obj)/signing_key.pem: $(obj)/x509.genkey
+ $(call cmd,gen_key)
quiet_cmd_copy_x509_config = COPY $@
cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@
--
2.30.2
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH 5/5] certs: use if_changed to re-generate the key when the key type is changed
2021-11-05 3:59 [PATCH 0/5] certs: various cleanups of certs/Makefile Masahiro Yamada
` (3 preceding siblings ...)
2021-11-05 3:59 ` [PATCH 4/5] certs: use 'cmd' to hide openssl output in silent builds more simply Masahiro Yamada
@ 2021-11-05 3:59 ` Masahiro Yamada
2021-12-11 18:42 ` [PATCH 0/5] certs: various cleanups of certs/Makefile Masahiro Yamada
5 siblings, 0 replies; 9+ messages in thread
From: Masahiro Yamada @ 2021-11-05 3:59 UTC (permalink / raw)
To: Jarkko Sakkinen, David Howells, David Woodhouse, keyrings
Cc: Arnd Bergmann, Masahiro Yamada, linux-kernel
If the key type of the existing signing key does not match to
CONFIG_MODULE_SIG_KEY_TYPE_*, the Makefile removes it so that it is
re-generated.
Use if_changed so that the key is re-generated when the key type is
changed (that is, the openssl command line is changed).
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---
certs/Makefile | 30 ++++++------------------------
1 file changed, 6 insertions(+), 24 deletions(-)
diff --git a/certs/Makefile b/certs/Makefile
index fdf206022113..a702b70f3cb9 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -51,41 +51,23 @@ ifdef SIGN_KEY
#
###############################################################################
-openssl_available = $(shell openssl help 2>/dev/null && echo yes)
-
# We do it this way rather than having a boolean option for enabling an
# external private key, because 'make randconfig' might enable such a
# boolean option and we unfortunately can't make it depend on !RANDCONFIG.
ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
-ifeq ($(openssl_available),yes)
-X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null)
-endif
-
-# Support user changing key type
-ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA
-keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1
-ifeq ($(openssl_available),yes)
-$(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))
-endif
-endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA
-
-ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA
-ifeq ($(openssl_available),yes)
-$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))
-endif
-endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA
+keytype-$(CONFIG_MODULE_SIG_KEY_TYPE_ECDSA) := -newkey ec -pkeyopt ec_paramgen_curve:secp384r1
quiet_cmd_gen_key = GENKEY $@
cmd_gen_key = openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
-batch -x509 -config $(obj)/x509.genkey \
-outform PEM -out $(obj)/signing_key.pem \
- -keyout $(obj)/signing_key.pem \
- $(keytype_openssl) \
- 2>&1
+ -keyout $(obj)/signing_key.pem $(keytype-y) 2>&1
+
+$(obj)/signing_key.pem: $(obj)/x509.genkey FORCE
+ $(call if_changed,gen_key)
-$(obj)/signing_key.pem: $(obj)/x509.genkey
- $(call cmd,gen_key)
+targets += signing_key.pem
quiet_cmd_copy_x509_config = COPY $@
cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@
--
2.30.2
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH 0/5] certs: various cleanups of certs/Makefile
2021-11-05 3:59 [PATCH 0/5] certs: various cleanups of certs/Makefile Masahiro Yamada
` (4 preceding siblings ...)
2021-11-05 3:59 ` [PATCH 5/5] certs: use if_changed to re-generate the key when the key type is changed Masahiro Yamada
@ 2021-12-11 18:42 ` Masahiro Yamada
5 siblings, 0 replies; 9+ messages in thread
From: Masahiro Yamada @ 2021-12-11 18:42 UTC (permalink / raw)
To: Jarkko Sakkinen, David Howells, David Woodhouse, keyrings
Cc: Arnd Bergmann, Linux Kernel Mailing List
On Fri, Nov 5, 2021 at 1:00 PM Masahiro Yamada <masahiroy@kernel.org> wrote:
>
>
>
>
> Masahiro Yamada (5):
> certs: remove meaningless $(error ...) in certs/Makefile
> certs: check-in the default x509 config file
> certs: remove noisy messages while generating the signing key
> certs: use 'cmd' to hide openssl output in silent builds more simply
> certs: use if_changed to re-generate the key when the key type is
> changed
>
> certs/Makefile | 74 ++++++++-------------------------------
> certs/default_x509.genkey | 17 +++++++++
> 2 files changed, 32 insertions(+), 59 deletions(-)
> create mode 100644 certs/default_x509.genkey
>
> --
> 2.30.2
>
Applied to linux-kbuild because this series is a prerequisite
of the next kbuild work.
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 9+ messages in thread