[PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist

[PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist

[Masahiro Yamada]

This file fails to compile as follows:

  CC      certs/blacklist_hashes.o
certs/blacklist_hashes.c:4:1: error: ignoring attribute ‘section (".init.data")’ because it conflicts with previous ‘section (".init.rodata")’ [-Werror=attributes]
    4 | const char __initdata *const blacklist_hashes[] = {
      | ^~~~~
In file included from certs/blacklist_hashes.c:2:
certs/blacklist.h:5:38: note: previous declaration here
    5 | extern const char __initconst *const blacklist_hashes[];
      |                                      ^~~~~~~~~~~~~~~~

Apply the same fix as commit 2be04df5668d ("certs/blacklist_nohashes.c:
fix const confusion in certs blacklist").

Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---

 certs/blacklist_hashes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
index 344892337be0..d5961aa3d338 100644
--- a/certs/blacklist_hashes.c
+++ b/certs/blacklist_hashes.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 #include "blacklist.h"
 
-const char __initdata *const blacklist_hashes[] = {
+const char __initconst *const blacklist_hashes[] = {
 #include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
 	, NULL
 };
-- 
2.32.0

[PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Masahiro Yamada]

Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
valid") was applied 8 months after the submission.

In the meantime, the base code had been removed by commit b8c96a6b466c
("certs: simplify $(srctree)/ handling and remove config_filename
macro").

Fix the Makefile.

Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
included from certs/blacklist_hashes.c and also works as a timestamp.

Send error messages from check-blacklist-hashes.awk to stderr instead
of stdout.

Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---

 certs/.gitignore         |  2 +-
 certs/Makefile           | 20 ++++++++++----------
 certs/blacklist_hashes.c |  2 +-
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/certs/.gitignore b/certs/.gitignore
index 56637aceaf81..cec5465f31c1 100644
--- a/certs/.gitignore
+++ b/certs/.gitignore
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0-only
-/blacklist_hashes_checked
+/blacklist_hash_list
 /extract-cert
 /x509_certificate_list
 /x509_revocation_list
diff --git a/certs/Makefile b/certs/Makefile
index cb1a9da3fc58..a8d628fd5f7b 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
 obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
 obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
 ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
-quiet_cmd_check_blacklist_hashes = CHECK   $(patsubst "%",%,$(2))
-      cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
 
-$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
+$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
+CFLAGS_blacklist_hashes.o := -I $(obj)
 
-$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
+quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
+      cmd_check_and_copy_blacklist_hash_list = \
+	$(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
+	cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
 
-CFLAGS_blacklist_hashes.o += -I$(srctree)
-
-targets += blacklist_hashes_checked
-$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
-	$(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
+$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
+	$(call if_changed,check_and_copy_blacklist_hash_list)
 obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
 else
 obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
 endif
+targets += blacklist_hash_list
 
 quiet_cmd_extract_certs  = CERT    $@
       cmd_extract_certs  = $(obj)/extract-cert $(extract-cert-in) $@
@@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
 $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
 	$(call if_changed,extract_certs)
 
-targets += x509_certificate_list blacklist_hashes_checked
+targets += x509_certificate_list
 
 # If module signing is requested, say by allyesconfig, but a key has not been
 # supplied, then one will need to be generated to make sure the build does not
diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
index d5961aa3d338..86d66fe11348 100644
--- a/certs/blacklist_hashes.c
+++ b/certs/blacklist_hashes.c
@@ -2,6 +2,6 @@
 #include "blacklist.h"
 
 const char __initconst *const blacklist_hashes[] = {
-#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
+#include "blacklist_hash_list"
 	, NULL
 };
-- 
2.32.0

[PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/

[Masahiro Yamada]

This script is only used in certs/Makefile, so certs/ is a better
home for it.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---

 MAINTAINERS                                   | 1 -
 certs/Makefile                                | 2 +-
 {scripts => certs}/check-blacklist-hashes.awk | 0
 3 files changed, 1 insertion(+), 2 deletions(-)
 rename {scripts => certs}/check-blacklist-hashes.awk (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 1fc9ead83d2a..7c2a7c304824 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4627,7 +4627,6 @@ L:	keyrings@vger.kernel.org
 S:	Maintained
 F:	Documentation/admin-guide/module-signing.rst
 F:	certs/
-F:	scripts/check-blacklist-hashes.awk
 F:	scripts/sign-file.c
 F:	tools/certs/
 
diff --git a/certs/Makefile b/certs/Makefile
index a8d628fd5f7b..df7aaeafd19c 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
 
 quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
       cmd_check_and_copy_blacklist_hash_list = \
-	$(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
+	$(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
 	cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
 
 $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
similarity index 100%
rename from scripts/check-blacklist-hashes.awk
rename to certs/check-blacklist-hashes.awk
-- 
2.32.0

[PATCH 4/4] certs: unify blacklist_hashes.c and blacklist_nohashes.c

[Masahiro Yamada]

These two files are very similar. Unify them.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---

 certs/Makefile             | 12 +++++-------
 certs/blacklist_hashes.c   |  1 -
 certs/blacklist_nohashes.c |  6 ------
 3 files changed, 5 insertions(+), 14 deletions(-)
 delete mode 100644 certs/blacklist_nohashes.c

diff --git a/certs/Makefile b/certs/Makefile
index df7aaeafd19c..7068d45db807 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -4,24 +4,22 @@
 #
 
 obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o common.o
-obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
+obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o blacklist_hashes.o
 obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
-ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
 
 $(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
 CFLAGS_blacklist_hashes.o := -I $(obj)
 
 quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
       cmd_check_and_copy_blacklist_hash_list = \
+	$(if $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST), \
 	$(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
-	cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
+	{ cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST); echo $(comma) NULL; } > $@, \
+	echo NULL > $@)
 
 $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
 	$(call if_changed,check_and_copy_blacklist_hash_list)
-obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
-else
-obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
-endif
+
 targets += blacklist_hash_list
 
 quiet_cmd_extract_certs  = CERT    $@
diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
index 86d66fe11348..0c5476abebd9 100644
--- a/certs/blacklist_hashes.c
+++ b/certs/blacklist_hashes.c
@@ -3,5 +3,4 @@
 
 const char __initconst *const blacklist_hashes[] = {
 #include "blacklist_hash_list"
-	, NULL
 };
diff --git a/certs/blacklist_nohashes.c b/certs/blacklist_nohashes.c
deleted file mode 100644
index 753b703ef0ef..000000000000
--- a/certs/blacklist_nohashes.c
+++ /dev/null
@@ -1,6 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-#include "blacklist.h"
-
-const char __initconst *const blacklist_hashes[] = {
-	NULL
-};
-- 
2.32.0

Re: [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist

[Mickaël Salaün]

On 11/06/2022 19:22, Masahiro Yamada wrote:
> This file fails to compile as follows:
> 
>    CC      certs/blacklist_hashes.o
> certs/blacklist_hashes.c:4:1: error: ignoring attribute ‘section (".init.data")’ because it conflicts with previous ‘section (".init.rodata")’ [-Werror=attributes]
>      4 | const char __initdata *const blacklist_hashes[] = {
>        | ^~~~~
> In file included from certs/blacklist_hashes.c:2:
> certs/blacklist.h:5:38: note: previous declaration here
>      5 | extern const char __initconst *const blacklist_hashes[];
>        |                                      ^~~~~~~~~~~~~~~~
> 
> Apply the same fix as commit 2be04df5668d ("certs/blacklist_nohashes.c:
> fix const confusion in certs blacklist").
> 
> Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring")
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>

Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>

> ---
> 
>   certs/blacklist_hashes.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index 344892337be0..d5961aa3d338 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -1,7 +1,7 @@
>   // SPDX-License-Identifier: GPL-2.0
>   #include "blacklist.h"
>   
> -const char __initdata *const blacklist_hashes[] = {
> +const char __initconst *const blacklist_hashes[] = {
>   #include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
>   	, NULL
>   };

Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Mickaël Salaün]

On 11/06/2022 19:22, Masahiro Yamada wrote:
> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> valid") was applied 8 months after the submission.
> 
> In the meantime, the base code had been removed by commit b8c96a6b466c
> ("certs: simplify $(srctree)/ handling and remove config_filename
> macro").
> 
> Fix the Makefile.
> 
> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> included from certs/blacklist_hashes.c and also works as a timestamp.
> 
> Send error messages from check-blacklist-hashes.awk to stderr instead
> of stdout.
> 
> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>

Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>

As a side note, it may let an orphan certs/blacklist_hashes_checked file 
but we can't really do something about that and it's OK.

Thanks!

> ---
> 
>   certs/.gitignore         |  2 +-
>   certs/Makefile           | 20 ++++++++++----------
>   certs/blacklist_hashes.c |  2 +-
>   3 files changed, 12 insertions(+), 12 deletions(-)
> 
> diff --git a/certs/.gitignore b/certs/.gitignore
> index 56637aceaf81..cec5465f31c1 100644
> --- a/certs/.gitignore
> +++ b/certs/.gitignore
> @@ -1,5 +1,5 @@
>   # SPDX-License-Identifier: GPL-2.0-only
> -/blacklist_hashes_checked
> +/blacklist_hash_list
>   /extract-cert
>   /x509_certificate_list
>   /x509_revocation_list
> diff --git a/certs/Makefile b/certs/Makefile
> index cb1a9da3fc58..a8d628fd5f7b 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
>   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
>   obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
>   ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> -quiet_cmd_check_blacklist_hashes = CHECK   $(patsubst "%",%,$(2))
> -      cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
>   
> -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> +CFLAGS_blacklist_hashes.o := -I $(obj)
>   
> -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> +quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
> +      cmd_check_and_copy_blacklist_hash_list = \
> +	$(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> +	cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>   
> -CFLAGS_blacklist_hashes.o += -I$(srctree)
> -
> -targets += blacklist_hashes_checked
> -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> -	$(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> +	$(call if_changed,check_and_copy_blacklist_hash_list)
>   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
>   else
>   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
>   endif
> +targets += blacklist_hash_list
>   
>   quiet_cmd_extract_certs  = CERT    $@
>         cmd_extract_certs  = $(obj)/extract-cert $(extract-cert-in) $@
> @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
>   $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
>   	$(call if_changed,extract_certs)
>   
> -targets += x509_certificate_list blacklist_hashes_checked
> +targets += x509_certificate_list
>   
>   # If module signing is requested, say by allyesconfig, but a key has not been
>   # supplied, then one will need to be generated to make sure the build does not
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index d5961aa3d338..86d66fe11348 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -2,6 +2,6 @@
>   #include "blacklist.h"
>   
>   const char __initconst *const blacklist_hashes[] = {
> -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> +#include "blacklist_hash_list"
>   	, NULL
>   };

Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/

[Mickaël Salaün]

On 11/06/2022 19:22, Masahiro Yamada wrote:
> This script is only used in certs/Makefile, so certs/ is a better
> home for it.
> 
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---
> 
>   MAINTAINERS                                   | 1 -
>   certs/Makefile                                | 2 +-
>   {scripts => certs}/check-blacklist-hashes.awk | 0
>   3 files changed, 1 insertion(+), 2 deletions(-)
>   rename {scripts => certs}/check-blacklist-hashes.awk (100%)
> 
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 1fc9ead83d2a..7c2a7c304824 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -4627,7 +4627,6 @@ L:	keyrings@vger.kernel.org
>   S:	Maintained
>   F:	Documentation/admin-guide/module-signing.rst
>   F:	certs/
> -F:	scripts/check-blacklist-hashes.awk >   F:	scripts/sign-file.c
>   F:	tools/certs/
>   
> diff --git a/certs/Makefile b/certs/Makefile
> index a8d628fd5f7b..df7aaeafd19c 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
>   
>   quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
>         cmd_check_and_copy_blacklist_hash_list = \
> -	$(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> +	$(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>   	cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>   
>   $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
> similarity index 100%
> rename from scripts/check-blacklist-hashes.awk
> rename to certs/check-blacklist-hashes.awk

It looks more appropriate and consistent to me to keep it in scripts/, 
close to other cert scripts. Is there some precedent to move such script?

Re: [PATCH 4/4] certs: unify blacklist_hashes.c and blacklist_nohashes.c

[Mickaël Salaün]

On 11/06/2022 19:22, Masahiro Yamada wrote:
> These two files are very similar. Unify them.
> 
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>

Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>

> ---
> 
>   certs/Makefile             | 12 +++++-------
>   certs/blacklist_hashes.c   |  1 -
>   certs/blacklist_nohashes.c |  6 ------
>   3 files changed, 5 insertions(+), 14 deletions(-)
>   delete mode 100644 certs/blacklist_nohashes.c
> 
> diff --git a/certs/Makefile b/certs/Makefile
> index df7aaeafd19c..7068d45db807 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -4,24 +4,22 @@
>   #
>   
>   obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o common.o
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> +obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o blacklist_hashes.o
>   obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> -ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
>   
>   $(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
>   CFLAGS_blacklist_hashes.o := -I $(obj)
>   
>   quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
>         cmd_check_and_copy_blacklist_hash_list = \
> +	$(if $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST), \
>   	$(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> -	cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> +	{ cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST); echo $(comma) NULL; } > $@, \
> +	echo NULL > $@)
>   
>   $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
>   	$(call if_changed,check_and_copy_blacklist_hash_list)
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> -else
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> -endif
> +
>   targets += blacklist_hash_list
>   
>   quiet_cmd_extract_certs  = CERT    $@
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index 86d66fe11348..0c5476abebd9 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -3,5 +3,4 @@
>   
>   const char __initconst *const blacklist_hashes[] = {
>   #include "blacklist_hash_list"
> -	, NULL
>   };
> diff --git a/certs/blacklist_nohashes.c b/certs/blacklist_nohashes.c
> deleted file mode 100644
> index 753b703ef0ef..000000000000
> --- a/certs/blacklist_nohashes.c
> +++ /dev/null
> @@ -1,6 +0,0 @@
> -// SPDX-License-Identifier: GPL-2.0
> -#include "blacklist.h"
> -
> -const char __initconst *const blacklist_hashes[] = {
> -	NULL
> -};

Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Masahiro Yamada]

On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <mic@digikod.net> wrote:
>
>
>
> On 11/06/2022 19:22, Masahiro Yamada wrote:
> > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > valid") was applied 8 months after the submission.
> >
> > In the meantime, the base code had been removed by commit b8c96a6b466c
> > ("certs: simplify $(srctree)/ handling and remove config_filename
> > macro").
> >
> > Fix the Makefile.
> >
> > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > included from certs/blacklist_hashes.c and also works as a timestamp.
> >
> > Send error messages from check-blacklist-hashes.awk to stderr instead
> > of stdout.
> >
> > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
>
> Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
>
> As a side note, it may let an orphan certs/blacklist_hashes_checked file
> but we can't really do something about that and it's OK.


GNU Make uses timestamps of files for dependency tracking,
so Kbuild keeps all intermediate files.

Keeping certs/blacklist_hashes_checked
is the right thing to do.



> Thanks!
>
> > ---
> >
> >   certs/.gitignore         |  2 +-
> >   certs/Makefile           | 20 ++++++++++----------
> >   certs/blacklist_hashes.c |  2 +-
> >   3 files changed, 12 insertions(+), 12 deletions(-)
> >
> > diff --git a/certs/.gitignore b/certs/.gitignore
> > index 56637aceaf81..cec5465f31c1 100644
> > --- a/certs/.gitignore
> > +++ b/certs/.gitignore
> > @@ -1,5 +1,5 @@
> >   # SPDX-License-Identifier: GPL-2.0-only
> > -/blacklist_hashes_checked
> > +/blacklist_hash_list
> >   /extract-cert
> >   /x509_certificate_list
> >   /x509_revocation_list
> > diff --git a/certs/Makefile b/certs/Makefile
> > index cb1a9da3fc58..a8d628fd5f7b 100644
> > --- a/certs/Makefile
> > +++ b/certs/Makefile
> > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> >   obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> >   ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > -quiet_cmd_check_blacklist_hashes = CHECK   $(patsubst "%",%,$(2))
> > -      cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> >
> > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > +CFLAGS_blacklist_hashes.o := -I $(obj)
> >
> > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
> > +      cmd_check_and_copy_blacklist_hash_list = \
> > +     $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > +     cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> >
> > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > -
> > -targets += blacklist_hashes_checked
> > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > -     $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > +     $(call if_changed,check_and_copy_blacklist_hash_list)
> >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> >   else
> >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> >   endif
> > +targets += blacklist_hash_list
> >
> >   quiet_cmd_extract_certs  = CERT    $@
> >         cmd_extract_certs  = $(obj)/extract-cert $(extract-cert-in) $@
> > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> >   $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> >       $(call if_changed,extract_certs)
> >
> > -targets += x509_certificate_list blacklist_hashes_checked
> > +targets += x509_certificate_list
> >
> >   # If module signing is requested, say by allyesconfig, but a key has not been
> >   # supplied, then one will need to be generated to make sure the build does not
> > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > index d5961aa3d338..86d66fe11348 100644
> > --- a/certs/blacklist_hashes.c
> > +++ b/certs/blacklist_hashes.c
> > @@ -2,6 +2,6 @@
> >   #include "blacklist.h"
> >
> >   const char __initconst *const blacklist_hashes[] = {
> > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > +#include "blacklist_hash_list"
> >       , NULL
> >   };



--
Best Regards
Masahiro Yamada

Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/

[Masahiro Yamada]

On Mon, Jun 13, 2022 at 9:36 PM Mickaël Salaün <mic@digikod.net> wrote:
>
>
>
> On 11/06/2022 19:22, Masahiro Yamada wrote:
> > This script is only used in certs/Makefile, so certs/ is a better
> > home for it.
> >
> > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> > ---
> >
> >   MAINTAINERS                                   | 1 -
> >   certs/Makefile                                | 2 +-
> >   {scripts => certs}/check-blacklist-hashes.awk | 0
> >   3 files changed, 1 insertion(+), 2 deletions(-)
> >   rename {scripts => certs}/check-blacklist-hashes.awk (100%)
> >
> > diff --git a/MAINTAINERS b/MAINTAINERS
> > index 1fc9ead83d2a..7c2a7c304824 100644
> > --- a/MAINTAINERS
> > +++ b/MAINTAINERS
> > @@ -4627,7 +4627,6 @@ L:      keyrings@vger.kernel.org
> >   S:  Maintained
> >   F:  Documentation/admin-guide/module-signing.rst
> >   F:  certs/
> > -F:   scripts/check-blacklist-hashes.awk >   F:       scripts/sign-file.c
> >   F:  tools/certs/
> >
> > diff --git a/certs/Makefile b/certs/Makefile
> > index a8d628fd5f7b..df7aaeafd19c 100644
> > --- a/certs/Makefile
> > +++ b/certs/Makefile
> > @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
> >
> >   quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
> >         cmd_check_and_copy_blacklist_hash_list = \
> > -     $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > +     $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> >       cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> >
> >   $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
> > similarity index 100%
> > rename from scripts/check-blacklist-hashes.awk
> > rename to certs/check-blacklist-hashes.awk
>
> It looks more appropriate and consistent to me to keep it in scripts/,
> close to other cert scripts. Is there some precedent to move such script?


I always did that.   For example,

  f6f57a46435d7253a52a1a07a58183678ad266a0
  78a20a012ecea857e438b1f9e8091acb290bd0f5
  28ba53c07638f31b153e3a32672a6124d0ff2a97
  4484aa800ac588a1fe2175cd53076c21067f44b4
  340a02535ee785c64c62a9c45706597a0139e972


Tools can stay in scripts/ if and only if:

  - it is used globally during kernel builds

  - it is still needed after the kernel builds.
     "make clean" removes most of the build artifacts
      but keeps ones under scripts/.




scripts/insert-sys-cert is apparently unneeded for building the kernel.
If the intended use is to manipulate vmlinux later,
that is the legitimate reason to stay in scripts/.
(but even better place might be tools/)


certs/signing_key.pem is needed even after kernel builds.
So, it should have been kept under scripts/ instead of certs/.





--
Best Regards
Masahiro Yamada

Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Mickaël Salaün]

On 13/06/2022 16:55, Masahiro Yamada wrote:
> On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <mic@digikod.net> wrote:
>>
>>
>>
>> On 11/06/2022 19:22, Masahiro Yamada wrote:
>>> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
>>> valid") was applied 8 months after the submission.
>>>
>>> In the meantime, the base code had been removed by commit b8c96a6b466c
>>> ("certs: simplify $(srctree)/ handling and remove config_filename
>>> macro").
>>>
>>> Fix the Makefile.
>>>
>>> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
>>> included from certs/blacklist_hashes.c and also works as a timestamp.
>>>
>>> Send error messages from check-blacklist-hashes.awk to stderr instead
>>> of stdout.
>>>
>>> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
>>> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
>>
>> Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
>>
>> As a side note, it may let an orphan certs/blacklist_hashes_checked file
>> but we can't really do something about that and it's OK.
> 
> 
> GNU Make uses timestamps of files for dependency tracking,
> so Kbuild keeps all intermediate files.
> 
> Keeping certs/blacklist_hashes_checked
> is the right thing to do.

blacklist_hashes_checked is the file you replaced with 
blacklist_hash_list, and is then not used in any Makefile anymore. There 
is then no timestamp issue. I just wanted to mention that it is normal 
that a git status will show it on build directories also used as source 
directories that were already using such feature.



> 
> 
> 
>> Thanks!
>>
>>> ---
>>>
>>>    certs/.gitignore         |  2 +-
>>>    certs/Makefile           | 20 ++++++++++----------
>>>    certs/blacklist_hashes.c |  2 +-
>>>    3 files changed, 12 insertions(+), 12 deletions(-)
>>>
>>> diff --git a/certs/.gitignore b/certs/.gitignore
>>> index 56637aceaf81..cec5465f31c1 100644
>>> --- a/certs/.gitignore
>>> +++ b/certs/.gitignore
>>> @@ -1,5 +1,5 @@
>>>    # SPDX-License-Identifier: GPL-2.0-only
>>> -/blacklist_hashes_checked
>>> +/blacklist_hash_list
>>>    /extract-cert
>>>    /x509_certificate_list
>>>    /x509_revocation_list
>>> diff --git a/certs/Makefile b/certs/Makefile
>>> index cb1a9da3fc58..a8d628fd5f7b 100644
>>> --- a/certs/Makefile
>>> +++ b/certs/Makefile
>>> @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
>>>    obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
>>>    obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
>>>    ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
>>> -quiet_cmd_check_blacklist_hashes = CHECK   $(patsubst "%",%,$(2))
>>> -      cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
>>>
>>> -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
>>> +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
>>> +CFLAGS_blacklist_hashes.o := -I $(obj)
>>>
>>> -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
>>> +quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
>>> +      cmd_check_and_copy_blacklist_hash_list = \
>>> +     $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>>> +     cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>>>
>>> -CFLAGS_blacklist_hashes.o += -I$(srctree)
>>> -
>>> -targets += blacklist_hashes_checked
>>> -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
>>> -     $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
>>> +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
>>> +     $(call if_changed,check_and_copy_blacklist_hash_list)
>>>    obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
>>>    else
>>>    obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
>>>    endif
>>> +targets += blacklist_hash_list
>>>
>>>    quiet_cmd_extract_certs  = CERT    $@
>>>          cmd_extract_certs  = $(obj)/extract-cert $(extract-cert-in) $@
>>> @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
>>>    $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
>>>        $(call if_changed,extract_certs)
>>>
>>> -targets += x509_certificate_list blacklist_hashes_checked
>>> +targets += x509_certificate_list
>>>
>>>    # If module signing is requested, say by allyesconfig, but a key has not been
>>>    # supplied, then one will need to be generated to make sure the build does not
>>> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
>>> index d5961aa3d338..86d66fe11348 100644
>>> --- a/certs/blacklist_hashes.c
>>> +++ b/certs/blacklist_hashes.c
>>> @@ -2,6 +2,6 @@
>>>    #include "blacklist.h"
>>>
>>>    const char __initconst *const blacklist_hashes[] = {
>>> -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
>>> +#include "blacklist_hash_list"
>>>        , NULL
>>>    };
> 
> 
> 
> --
> Best Regards
> Masahiro Yamada

Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/

[Mickaël Salaün]

On 13/06/2022 17:28, Masahiro Yamada wrote:
> On Mon, Jun 13, 2022 at 9:36 PM Mickaël Salaün <mic@digikod.net> wrote:
>>
>>
>>
>> On 11/06/2022 19:22, Masahiro Yamada wrote:
>>> This script is only used in certs/Makefile, so certs/ is a better
>>> home for it.
>>>
>>> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
>>> ---
>>>
>>>    MAINTAINERS                                   | 1 -
>>>    certs/Makefile                                | 2 +-
>>>    {scripts => certs}/check-blacklist-hashes.awk | 0
>>>    3 files changed, 1 insertion(+), 2 deletions(-)
>>>    rename {scripts => certs}/check-blacklist-hashes.awk (100%)
>>>
>>> diff --git a/MAINTAINERS b/MAINTAINERS
>>> index 1fc9ead83d2a..7c2a7c304824 100644
>>> --- a/MAINTAINERS
>>> +++ b/MAINTAINERS
>>> @@ -4627,7 +4627,6 @@ L:      keyrings@vger.kernel.org
>>>    S:  Maintained
>>>    F:  Documentation/admin-guide/module-signing.rst
>>>    F:  certs/
>>> -F:   scripts/check-blacklist-hashes.awk >   F:       scripts/sign-file.c
>>>    F:  tools/certs/
>>>
>>> diff --git a/certs/Makefile b/certs/Makefile
>>> index a8d628fd5f7b..df7aaeafd19c 100644
>>> --- a/certs/Makefile
>>> +++ b/certs/Makefile
>>> @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
>>>
>>>    quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
>>>          cmd_check_and_copy_blacklist_hash_list = \
>>> -     $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>>> +     $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>>>        cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>>>
>>>    $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
>>> diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
>>> similarity index 100%
>>> rename from scripts/check-blacklist-hashes.awk
>>> rename to certs/check-blacklist-hashes.awk
>>
>> It looks more appropriate and consistent to me to keep it in scripts/,
>> close to other cert scripts. Is there some precedent to move such script?
> 
> 
> I always did that.   For example,
> 
>    f6f57a46435d7253a52a1a07a58183678ad266a0
>    78a20a012ecea857e438b1f9e8091acb290bd0f5
>    28ba53c07638f31b153e3a32672a6124d0ff2a97
>    4484aa800ac588a1fe2175cd53076c21067f44b4
>    340a02535ee785c64c62a9c45706597a0139e972
> 
> 
> Tools can stay in scripts/ if and only if:
> 
>    - it is used globally during kernel builds
> 
>    - it is still needed after the kernel builds.
>       "make clean" removes most of the build artifacts
>        but keeps ones under scripts/.
> 

OK, it would be nice to have these rules in the documentation (didn't 
find them).

Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>

> 
> 
> scripts/insert-sys-cert is apparently unneeded for building the kernel.
> If the intended use is to manipulate vmlinux later,
> that is the legitimate reason to stay in scripts/.
> (but even better place might be tools/)
> 
> 
> certs/signing_key.pem is needed even after kernel builds.
> So, it should have been kept under scripts/ instead of certs/.
> 
> 
> 
> 
> 
> --
> Best Regards
> Masahiro Yamada

Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Masahiro Yamada]

On Tue, Jun 14, 2022 at 3:06 AM Mickaël Salaün <mic@digikod.net> wrote:
>
>
> On 13/06/2022 16:55, Masahiro Yamada wrote:
> > On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <mic@digikod.net> wrote:
> >>
> >>
> >>
> >> On 11/06/2022 19:22, Masahiro Yamada wrote:
> >>> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> >>> valid") was applied 8 months after the submission.
> >>>
> >>> In the meantime, the base code had been removed by commit b8c96a6b466c
> >>> ("certs: simplify $(srctree)/ handling and remove config_filename
> >>> macro").
> >>>
> >>> Fix the Makefile.
> >>>
> >>> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> >>> included from certs/blacklist_hashes.c and also works as a timestamp.
> >>>
> >>> Send error messages from check-blacklist-hashes.awk to stderr instead
> >>> of stdout.
> >>>
> >>> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> >>> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> >>
> >> Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> >>
> >> As a side note, it may let an orphan certs/blacklist_hashes_checked file
> >> but we can't really do something about that and it's OK.
> >
> >
> > GNU Make uses timestamps of files for dependency tracking,
> > so Kbuild keeps all intermediate files.
> >
> > Keeping certs/blacklist_hashes_checked
> > is the right thing to do.
>
> blacklist_hashes_checked is the file you replaced with
> blacklist_hash_list, and is then not used in any Makefile anymore. There
> is then no timestamp issue. I just wanted to mention that it is normal
> that a git status will show it on build directories also used as source
> directories that were already using such feature.


Ah, sorry, I misunderstood your feedback.

If 'git status' is your concern,
we can add certs/blacklist_hashes_checked
to scripts/remove-stale-files.

addf466389d9d78f255e8b15ac44ab4791029852
was merged into mainline just recently, and
not contained in any release.

But, if the orphan timestamp matters, I will do it.
It is just a one-liner addition.






--
Best Regards
Masahiro Yamada

Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Mickaël Salaün]

On 13/06/2022 20:56, Masahiro Yamada wrote:
> On Tue, Jun 14, 2022 at 3:06 AM Mickaël Salaün <mic@digikod.net> wrote:
>>
>>
>> On 13/06/2022 16:55, Masahiro Yamada wrote:
>>> On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <mic@digikod.net> wrote:
>>>>
>>>>
>>>>
>>>> On 11/06/2022 19:22, Masahiro Yamada wrote:
>>>>> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
>>>>> valid") was applied 8 months after the submission.
>>>>>
>>>>> In the meantime, the base code had been removed by commit b8c96a6b466c
>>>>> ("certs: simplify $(srctree)/ handling and remove config_filename
>>>>> macro").
>>>>>
>>>>> Fix the Makefile.
>>>>>
>>>>> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
>>>>> included from certs/blacklist_hashes.c and also works as a timestamp.
>>>>>
>>>>> Send error messages from check-blacklist-hashes.awk to stderr instead
>>>>> of stdout.
>>>>>
>>>>> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
>>>>> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
>>>>
>>>> Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
>>>>
>>>> As a side note, it may let an orphan certs/blacklist_hashes_checked file
>>>> but we can't really do something about that and it's OK.
>>>
>>>
>>> GNU Make uses timestamps of files for dependency tracking,
>>> so Kbuild keeps all intermediate files.
>>>
>>> Keeping certs/blacklist_hashes_checked
>>> is the right thing to do.
>>
>> blacklist_hashes_checked is the file you replaced with
>> blacklist_hash_list, and is then not used in any Makefile anymore. There
>> is then no timestamp issue. I just wanted to mention that it is normal
>> that a git status will show it on build directories also used as source
>> directories that were already using such feature.
> 
> 
> Ah, sorry, I misunderstood your feedback.
> 
> If 'git status' is your concern,
> we can add certs/blacklist_hashes_checked
> to scripts/remove-stale-files.
> 
> addf466389d9d78f255e8b15ac44ab4791029852
> was merged into mainline just recently, and
> not contained in any release.

Indeed, it's all good then.

> 
> But, if the orphan timestamp matters, I will do it.
> It is just a one-liner addition.

Re: [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist

[Jarkko Sakkinen]

On Sun, Jun 12, 2022 at 02:22:30AM +0900, Masahiro Yamada wrote:
> This file fails to compile as follows:
> 
>   CC      certs/blacklist_hashes.o
> certs/blacklist_hashes.c:4:1: error: ignoring attribute ‘section (".init.data")’ because it conflicts with previous ‘section (".init.rodata")’ [-Werror=attributes]
>     4 | const char __initdata *const blacklist_hashes[] = {
>       | ^~~~~
> In file included from certs/blacklist_hashes.c:2:
> certs/blacklist.h:5:38: note: previous declaration here
>     5 | extern const char __initconst *const blacklist_hashes[];
>       |                                      ^~~~~~~~~~~~~~~~
> 
> Apply the same fix as commit 2be04df5668d ("certs/blacklist_nohashes.c:
> fix const confusion in certs blacklist").
> 
> Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring")
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---
> 
>  certs/blacklist_hashes.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index 344892337be0..d5961aa3d338 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -1,7 +1,7 @@
>  // SPDX-License-Identifier: GPL-2.0
>  #include "blacklist.h"
>  
> -const char __initdata *const blacklist_hashes[] = {
> +const char __initconst *const blacklist_hashes[] = {
>  #include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
>  	, NULL
>  };
> -- 
> 2.32.0
> 

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

BR, Jarkko

Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Jarkko Sakkinen]

On Sun, Jun 12, 2022 at 02:22:31AM +0900, Masahiro Yamada wrote:
> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> valid") was applied 8 months after the submission.
> 
> In the meantime, the base code had been removed by commit b8c96a6b466c
> ("certs: simplify $(srctree)/ handling and remove config_filename
> macro").
> 
> Fix the Makefile.
> 
> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> included from certs/blacklist_hashes.c and also works as a timestamp.
> 
> Send error messages from check-blacklist-hashes.awk to stderr instead
> of stdout.
> 
> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---
> 
>  certs/.gitignore         |  2 +-
>  certs/Makefile           | 20 ++++++++++----------
>  certs/blacklist_hashes.c |  2 +-
>  3 files changed, 12 insertions(+), 12 deletions(-)
> 
> diff --git a/certs/.gitignore b/certs/.gitignore
> index 56637aceaf81..cec5465f31c1 100644
> --- a/certs/.gitignore
> +++ b/certs/.gitignore
> @@ -1,5 +1,5 @@
>  # SPDX-License-Identifier: GPL-2.0-only
> -/blacklist_hashes_checked
> +/blacklist_hash_list
>  /extract-cert
>  /x509_certificate_list
>  /x509_revocation_list
> diff --git a/certs/Makefile b/certs/Makefile
> index cb1a9da3fc58..a8d628fd5f7b 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
>  obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
>  obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
>  ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> -quiet_cmd_check_blacklist_hashes = CHECK   $(patsubst "%",%,$(2))
> -      cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
>  
> -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> +CFLAGS_blacklist_hashes.o := -I $(obj)
>  
> -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> +quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
> +      cmd_check_and_copy_blacklist_hash_list = \
> +	$(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> +	cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>  
> -CFLAGS_blacklist_hashes.o += -I$(srctree)
> -
> -targets += blacklist_hashes_checked
> -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> -	$(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> +	$(call if_changed,check_and_copy_blacklist_hash_list)
>  obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
>  else
>  obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
>  endif
> +targets += blacklist_hash_list
>  
>  quiet_cmd_extract_certs  = CERT    $@
>        cmd_extract_certs  = $(obj)/extract-cert $(extract-cert-in) $@
> @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
>  $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
>  	$(call if_changed,extract_certs)
>  
> -targets += x509_certificate_list blacklist_hashes_checked
> +targets += x509_certificate_list
>  
>  # If module signing is requested, say by allyesconfig, but a key has not been
>  # supplied, then one will need to be generated to make sure the build does not
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index d5961aa3d338..86d66fe11348 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -2,6 +2,6 @@
>  #include "blacklist.h"
>  
>  const char __initconst *const blacklist_hashes[] = {
> -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> +#include "blacklist_hash_list"
>  	, NULL
>  };
> -- 
> 2.32.0
> 

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

BR, Jarkko

Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/

[Jarkko Sakkinen]

On Sun, Jun 12, 2022 at 02:22:32AM +0900, Masahiro Yamada wrote:
> This script is only used in certs/Makefile, so certs/ is a better
> home for it.
> 
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---
> 
>  MAINTAINERS                                   | 1 -
>  certs/Makefile                                | 2 +-
>  {scripts => certs}/check-blacklist-hashes.awk | 0
>  3 files changed, 1 insertion(+), 2 deletions(-)
>  rename {scripts => certs}/check-blacklist-hashes.awk (100%)
> 
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 1fc9ead83d2a..7c2a7c304824 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -4627,7 +4627,6 @@ L:	keyrings@vger.kernel.org
>  S:	Maintained
>  F:	Documentation/admin-guide/module-signing.rst
>  F:	certs/
> -F:	scripts/check-blacklist-hashes.awk
>  F:	scripts/sign-file.c
>  F:	tools/certs/
>  
> diff --git a/certs/Makefile b/certs/Makefile
> index a8d628fd5f7b..df7aaeafd19c 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
>  
>  quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
>        cmd_check_and_copy_blacklist_hash_list = \
> -	$(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> +	$(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>  	cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>  
>  $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
> similarity index 100%
> rename from scripts/check-blacklist-hashes.awk
> rename to certs/check-blacklist-hashes.awk
> -- 
> 2.32.0
> 

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

BR, Jarkko

Re: [PATCH 4/4] certs: unify blacklist_hashes.c and blacklist_nohashes.c

[Jarkko Sakkinen]

On Sun, Jun 12, 2022 at 02:22:33AM +0900, Masahiro Yamada wrote:
> These two files are very similar. Unify them.
> 
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---
> 
>  certs/Makefile             | 12 +++++-------
>  certs/blacklist_hashes.c   |  1 -
>  certs/blacklist_nohashes.c |  6 ------
>  3 files changed, 5 insertions(+), 14 deletions(-)
>  delete mode 100644 certs/blacklist_nohashes.c
> 
> diff --git a/certs/Makefile b/certs/Makefile
> index df7aaeafd19c..7068d45db807 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -4,24 +4,22 @@
>  #
>  
>  obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o common.o
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> +obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o blacklist_hashes.o
>  obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> -ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
>  
>  $(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
>  CFLAGS_blacklist_hashes.o := -I $(obj)
>  
>  quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
>        cmd_check_and_copy_blacklist_hash_list = \
> +	$(if $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST), \
>  	$(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> -	cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> +	{ cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST); echo $(comma) NULL; } > $@, \
> +	echo NULL > $@)
>  
>  $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
>  	$(call if_changed,check_and_copy_blacklist_hash_list)
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> -else
> -obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> -endif
> +
>  targets += blacklist_hash_list
>  
>  quiet_cmd_extract_certs  = CERT    $@
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index 86d66fe11348..0c5476abebd9 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -3,5 +3,4 @@
>  
>  const char __initconst *const blacklist_hashes[] = {
>  #include "blacklist_hash_list"
> -	, NULL
>  };
> diff --git a/certs/blacklist_nohashes.c b/certs/blacklist_nohashes.c
> deleted file mode 100644
> index 753b703ef0ef..000000000000
> --- a/certs/blacklist_nohashes.c
> +++ /dev/null
> @@ -1,6 +0,0 @@
> -// SPDX-License-Identifier: GPL-2.0
> -#include "blacklist.h"
> -
> -const char __initconst *const blacklist_hashes[] = {
> -	NULL
> -};
> -- 
> 2.32.0
> 

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

BR, Jarkko

Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Jarkko Sakkinen]

On Mon, Jun 13, 2022 at 02:34:36PM +0200, Mickaël Salaün wrote:
> 
> 
> On 11/06/2022 19:22, Masahiro Yamada wrote:
> > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > valid") was applied 8 months after the submission.
> > 
> > In the meantime, the base code had been removed by commit b8c96a6b466c
> > ("certs: simplify $(srctree)/ handling and remove config_filename
> > macro").
> > 
> > Fix the Makefile.
> > 
> > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > included from certs/blacklist_hashes.c and also works as a timestamp.
> > 
> > Send error messages from check-blacklist-hashes.awk to stderr instead
> > of stdout.
> > 
> > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> 
> Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> 
> As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> we can't really do something about that and it's OK.
> 
> Thanks!
> 
> > ---
> > 
> >   certs/.gitignore         |  2 +-
> >   certs/Makefile           | 20 ++++++++++----------
> >   certs/blacklist_hashes.c |  2 +-
> >   3 files changed, 12 insertions(+), 12 deletions(-)
> > 
> > diff --git a/certs/.gitignore b/certs/.gitignore
> > index 56637aceaf81..cec5465f31c1 100644
> > --- a/certs/.gitignore
> > +++ b/certs/.gitignore
> > @@ -1,5 +1,5 @@
> >   # SPDX-License-Identifier: GPL-2.0-only
> > -/blacklist_hashes_checked
> > +/blacklist_hash_list
> >   /extract-cert
> >   /x509_certificate_list
> >   /x509_revocation_list
> > diff --git a/certs/Makefile b/certs/Makefile
> > index cb1a9da3fc58..a8d628fd5f7b 100644
> > --- a/certs/Makefile
> > +++ b/certs/Makefile
> > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> >   obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> >   ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > -quiet_cmd_check_blacklist_hashes = CHECK   $(patsubst "%",%,$(2))
> > -      cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
> > +      cmd_check_and_copy_blacklist_hash_list = \
> > +	$(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > +	cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > -
> > -targets += blacklist_hashes_checked
> > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > -	$(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > +	$(call if_changed,check_and_copy_blacklist_hash_list)
> >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> >   else
> >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> >   endif
> > +targets += blacklist_hash_list
> >   quiet_cmd_extract_certs  = CERT    $@
> >         cmd_extract_certs  = $(obj)/extract-cert $(extract-cert-in) $@
> > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> >   $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> >   	$(call if_changed,extract_certs)
> > -targets += x509_certificate_list blacklist_hashes_checked
> > +targets += x509_certificate_list
> >   # If module signing is requested, say by allyesconfig, but a key has not been
> >   # supplied, then one will need to be generated to make sure the build does not
> > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > index d5961aa3d338..86d66fe11348 100644
> > --- a/certs/blacklist_hashes.c
> > +++ b/certs/blacklist_hashes.c
> > @@ -2,6 +2,6 @@
> >   #include "blacklist.h"
> >   const char __initconst *const blacklist_hashes[] = {
> > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > +#include "blacklist_hash_list"
> >   	, NULL
> >   };

I'll make a PR for 1/4 and 2/4 so that they get into 5.19.

BR, Jarkko

Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Masahiro Yamada]

On Thu, Jun 16, 2022 at 3:51 AM Jarkko Sakkinen <jarkko@kernel.org> wrote:
>
> On Mon, Jun 13, 2022 at 02:34:36PM +0200, Mickaël Salaün wrote:
> >
> >
> > On 11/06/2022 19:22, Masahiro Yamada wrote:
> > > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > > valid") was applied 8 months after the submission.
> > >
> > > In the meantime, the base code had been removed by commit b8c96a6b466c
> > > ("certs: simplify $(srctree)/ handling and remove config_filename
> > > macro").
> > >
> > > Fix the Makefile.
> > >
> > > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > > included from certs/blacklist_hashes.c and also works as a timestamp.
> > >
> > > Send error messages from check-blacklist-hashes.awk to stderr instead
> > > of stdout.
> > >
> > > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> >
> > Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> >
> > As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> > we can't really do something about that and it's OK.
> >
> > Thanks!
> >
> > > ---
> > >
> > >   certs/.gitignore         |  2 +-
> > >   certs/Makefile           | 20 ++++++++++----------
> > >   certs/blacklist_hashes.c |  2 +-
> > >   3 files changed, 12 insertions(+), 12 deletions(-)
> > >
> > > diff --git a/certs/.gitignore b/certs/.gitignore
> > > index 56637aceaf81..cec5465f31c1 100644
> > > --- a/certs/.gitignore
> > > +++ b/certs/.gitignore
> > > @@ -1,5 +1,5 @@
> > >   # SPDX-License-Identifier: GPL-2.0-only
> > > -/blacklist_hashes_checked
> > > +/blacklist_hash_list
> > >   /extract-cert
> > >   /x509_certificate_list
> > >   /x509_revocation_list
> > > diff --git a/certs/Makefile b/certs/Makefile
> > > index cb1a9da3fc58..a8d628fd5f7b 100644
> > > --- a/certs/Makefile
> > > +++ b/certs/Makefile
> > > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > >   obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > >   ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > > -quiet_cmd_check_blacklist_hashes = CHECK   $(patsubst "%",%,$(2))
> > > -      cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
> > > +      cmd_check_and_copy_blacklist_hash_list = \
> > > +   $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > > +   cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > > -
> > > -targets += blacklist_hashes_checked
> > > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > > -   $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > > +   $(call if_changed,check_and_copy_blacklist_hash_list)
> > >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > >   else
> > >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > >   endif
> > > +targets += blacklist_hash_list
> > >   quiet_cmd_extract_certs  = CERT    $@
> > >         cmd_extract_certs  = $(obj)/extract-cert $(extract-cert-in) $@
> > > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > >   $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > >     $(call if_changed,extract_certs)
> > > -targets += x509_certificate_list blacklist_hashes_checked
> > > +targets += x509_certificate_list
> > >   # If module signing is requested, say by allyesconfig, but a key has not been
> > >   # supplied, then one will need to be generated to make sure the build does not
> > > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > > index d5961aa3d338..86d66fe11348 100644
> > > --- a/certs/blacklist_hashes.c
> > > +++ b/certs/blacklist_hashes.c
> > > @@ -2,6 +2,6 @@
> > >   #include "blacklist.h"
> > >   const char __initconst *const blacklist_hashes[] = {
> > > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > > +#include "blacklist_hash_list"
> > >     , NULL
> > >   };
>
> I'll make a PR for 1/4 and 2/4 so that they get into 5.19.
>
> BR, Jarkko


Thank you!

What shall we do for 3/4 and 4/4?

Do you have a plan to queue them up for the next MW?

Or, shall I apply them to my kbuild tree with your reivewed-by?




-- 
Best Regards
Masahiro Yamada

Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Jarkko Sakkinen]

On Sun, Jun 19, 2022 at 07:12:31AM +0900, Masahiro Yamada wrote:
> On Thu, Jun 16, 2022 at 3:51 AM Jarkko Sakkinen <jarkko@kernel.org> wrote:
> >
> > On Mon, Jun 13, 2022 at 02:34:36PM +0200, Mickaël Salaün wrote:
> > >
> > >
> > > On 11/06/2022 19:22, Masahiro Yamada wrote:
> > > > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > > > valid") was applied 8 months after the submission.
> > > >
> > > > In the meantime, the base code had been removed by commit b8c96a6b466c
> > > > ("certs: simplify $(srctree)/ handling and remove config_filename
> > > > macro").
> > > >
> > > > Fix the Makefile.
> > > >
> > > > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > > > included from certs/blacklist_hashes.c and also works as a timestamp.
> > > >
> > > > Send error messages from check-blacklist-hashes.awk to stderr instead
> > > > of stdout.
> > > >
> > > > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > > > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> > >
> > > Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> > >
> > > As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> > > we can't really do something about that and it's OK.
> > >
> > > Thanks!
> > >
> > > > ---
> > > >
> > > >   certs/.gitignore         |  2 +-
> > > >   certs/Makefile           | 20 ++++++++++----------
> > > >   certs/blacklist_hashes.c |  2 +-
> > > >   3 files changed, 12 insertions(+), 12 deletions(-)
> > > >
> > > > diff --git a/certs/.gitignore b/certs/.gitignore
> > > > index 56637aceaf81..cec5465f31c1 100644
> > > > --- a/certs/.gitignore
> > > > +++ b/certs/.gitignore
> > > > @@ -1,5 +1,5 @@
> > > >   # SPDX-License-Identifier: GPL-2.0-only
> > > > -/blacklist_hashes_checked
> > > > +/blacklist_hash_list
> > > >   /extract-cert
> > > >   /x509_certificate_list
> > > >   /x509_revocation_list
> > > > diff --git a/certs/Makefile b/certs/Makefile
> > > > index cb1a9da3fc58..a8d628fd5f7b 100644
> > > > --- a/certs/Makefile
> > > > +++ b/certs/Makefile
> > > > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > > >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > > >   obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > > >   ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > > > -quiet_cmd_check_blacklist_hashes = CHECK   $(patsubst "%",%,$(2))
> > > > -      cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > > > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > > > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > > > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > > > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > > > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
> > > > +      cmd_check_and_copy_blacklist_hash_list = \
> > > > +   $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > > > +   cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > > > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > > > -
> > > > -targets += blacklist_hashes_checked
> > > > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > > > -   $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > > > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > > > +   $(call if_changed,check_and_copy_blacklist_hash_list)
> > > >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > > >   else
> > > >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > > >   endif
> > > > +targets += blacklist_hash_list
> > > >   quiet_cmd_extract_certs  = CERT    $@
> > > >         cmd_extract_certs  = $(obj)/extract-cert $(extract-cert-in) $@
> > > > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > > >   $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > > >     $(call if_changed,extract_certs)
> > > > -targets += x509_certificate_list blacklist_hashes_checked
> > > > +targets += x509_certificate_list
> > > >   # If module signing is requested, say by allyesconfig, but a key has not been
> > > >   # supplied, then one will need to be generated to make sure the build does not
> > > > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > > > index d5961aa3d338..86d66fe11348 100644
> > > > --- a/certs/blacklist_hashes.c
> > > > +++ b/certs/blacklist_hashes.c
> > > > @@ -2,6 +2,6 @@
> > > >   #include "blacklist.h"
> > > >   const char __initconst *const blacklist_hashes[] = {
> > > > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > > > +#include "blacklist_hash_list"
> > > >     , NULL
> > > >   };
> >
> > I'll make a PR for 1/4 and 2/4 so that they get into 5.19.
> >
> > BR, Jarkko
> 
> 
> Thank you!
> 
> What shall we do for 3/4 and 4/4?
> 
> Do you have a plan to queue them up for the next MW?
> 
> Or, shall I apply them to my kbuild tree with your reivewed-by?

If possible, please do, thank you for taking the trouble.

BR, Jarkko

Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

[Masahiro Yamada]

On Sun, Jun 26, 2022 at 3:16 PM Jarkko Sakkinen <jarkko@kernel.org> wrote:
>
> On Sun, Jun 19, 2022 at 07:12:31AM +0900, Masahiro Yamada wrote:
> > On Thu, Jun 16, 2022 at 3:51 AM Jarkko Sakkinen <jarkko@kernel.org> wrote:
> > >
> > > On Mon, Jun 13, 2022 at 02:34:36PM +0200, Mickaël Salaün wrote:
> > > >
> > > >
> > > > On 11/06/2022 19:22, Masahiro Yamada wrote:
> > > > > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > > > > valid") was applied 8 months after the submission.
> > > > >
> > > > > In the meantime, the base code had been removed by commit b8c96a6b466c
> > > > > ("certs: simplify $(srctree)/ handling and remove config_filename
> > > > > macro").
> > > > >
> > > > > Fix the Makefile.
> > > > >
> > > > > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > > > > included from certs/blacklist_hashes.c and also works as a timestamp.
> > > > >
> > > > > Send error messages from check-blacklist-hashes.awk to stderr instead
> > > > > of stdout.
> > > > >
> > > > > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > > > > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> > > >
> > > > Reviewed-by: Mickaël Salaün <mic@linux.microsoft.com>
> > > >
> > > > As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> > > > we can't really do something about that and it's OK.
> > > >
> > > > Thanks!
> > > >
> > > > > ---
> > > > >
> > > > >   certs/.gitignore         |  2 +-
> > > > >   certs/Makefile           | 20 ++++++++++----------
> > > > >   certs/blacklist_hashes.c |  2 +-
> > > > >   3 files changed, 12 insertions(+), 12 deletions(-)
> > > > >
> > > > > diff --git a/certs/.gitignore b/certs/.gitignore
> > > > > index 56637aceaf81..cec5465f31c1 100644
> > > > > --- a/certs/.gitignore
> > > > > +++ b/certs/.gitignore
> > > > > @@ -1,5 +1,5 @@
> > > > >   # SPDX-License-Identifier: GPL-2.0-only
> > > > > -/blacklist_hashes_checked
> > > > > +/blacklist_hash_list
> > > > >   /extract-cert
> > > > >   /x509_certificate_list
> > > > >   /x509_revocation_list
> > > > > diff --git a/certs/Makefile b/certs/Makefile
> > > > > index cb1a9da3fc58..a8d628fd5f7b 100644
> > > > > --- a/certs/Makefile
> > > > > +++ b/certs/Makefile
> > > > > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > > > >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > > > >   obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > > > >   ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > > > > -quiet_cmd_check_blacklist_hashes = CHECK   $(patsubst "%",%,$(2))
> > > > > -      cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > > > > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > > > > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > > > > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > > > > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > > > > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN     $@
> > > > > +      cmd_check_and_copy_blacklist_hash_list = \
> > > > > +   $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > > > > +   cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > > > > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > > > > -
> > > > > -targets += blacklist_hashes_checked
> > > > > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > > > > -   $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > > > > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > > > > +   $(call if_changed,check_and_copy_blacklist_hash_list)
> > > > >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > > > >   else
> > > > >   obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > > > >   endif
> > > > > +targets += blacklist_hash_list
> > > > >   quiet_cmd_extract_certs  = CERT    $@
> > > > >         cmd_extract_certs  = $(obj)/extract-cert $(extract-cert-in) $@
> > > > > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > > > >   $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > > > >     $(call if_changed,extract_certs)
> > > > > -targets += x509_certificate_list blacklist_hashes_checked
> > > > > +targets += x509_certificate_list
> > > > >   # If module signing is requested, say by allyesconfig, but a key has not been
> > > > >   # supplied, then one will need to be generated to make sure the build does not
> > > > > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > > > > index d5961aa3d338..86d66fe11348 100644
> > > > > --- a/certs/blacklist_hashes.c
> > > > > +++ b/certs/blacklist_hashes.c
> > > > > @@ -2,6 +2,6 @@
> > > > >   #include "blacklist.h"
> > > > >   const char __initconst *const blacklist_hashes[] = {
> > > > > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > > > > +#include "blacklist_hash_list"
> > > > >     , NULL
> > > > >   };
> > >
> > > I'll make a PR for 1/4 and 2/4 so that they get into 5.19.
> > >
> > > BR, Jarkko
> >
> >
> > Thank you!
> >
> > What shall we do for 3/4 and 4/4?
> >
> > Do you have a plan to queue them up for the next MW?
> >
> > Or, shall I apply them to my kbuild tree with your reivewed-by?
>
> If possible, please do, thank you for taking the trouble.
>
> BR, Jarkko

Now, 3/4 and 4/4 applied to linux-kbuild.
Thanks.


-- 
Best Regards
Masahiro Yamada