From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755270AbbBTWKQ (ORCPT ); Fri, 20 Feb 2015 17:10:16 -0500 Received: from cantor2.suse.de ([195.135.220.15]:36236 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755209AbbBTWKO (ORCPT ); Fri, 20 Feb 2015 17:10:14 -0500 Date: Fri, 20 Feb 2015 23:10:12 +0100 From: Michal Marek To: David Howells Cc: keyrings@linux-nfs.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] X.509: Fix certificate gathering again Message-ID: <20150220221012.GA19328@pobox.suse.cz> References: <1412773409-29102-1-git-send-email-mmarek@suse.cz> <11027.1424348805@warthog.procyon.org.uk> <54E73C0E.1090905@suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <54E73C0E.1090905@suse.cz> User-Agent: Mutt/1.5.17 (2007-11-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Feb 20, 2015 at 02:52:14PM +0100, Michal Marek wrote: > On 2015-02-19 13:26, David Howells wrote: > > Michal Marek wrote: > > > >> +X509_CERTIFICATES-y := $(wildcard *.x509) > >> +ifneq ($(objtree),$(srctree)) > >> +X509_CERTIFICATES-y += $(wildcard $(srctree)/*.x509) > >> +endif > >> +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 > >> +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) > > > > What will happen if there's a "signing_key.x509" in the source tree when O= is > > used? > > It will fail. So the patch needs more work, thanks for the review. OK, this works for me and I finally understand why :). The problem is that whatever file make sees (as a target or dependency) first, it will prefer it for the purpose of VPATH search, so the right signing_key.x509 must come first. Unfortunately, using 'vpath %.x509' does not do the trick, because this merely says not to use any special VPATH for files matching this pattern, but it does not avoid the global VPATH. >>From 1774298ef0fa770cd7e8810ed57ceb4e8a7c5def Mon Sep 17 00:00:00 2001 From: Michal Marek Date: Wed, 8 Oct 2014 13:15:28 +0200 Subject: [PATCH] X.509: Fix certificate gathering again Commit d7ec435f (X.509: Fix certificate gathering) fixed the issue of changing .x509.list, but in the CONFIG_MODULE_SIG=y case, it assumed that $(objtree) was an absolute path. Commit 7e1c0477 (kbuild: Use relative path for $(objtree)) broke this assumption and we get uncecessary rebuilds again, due to ./signing_key.x509 changing to signing_key.x509. Instead of prepending the absolute path and stripping it again, just check if $(srctree) and $(objtree) are different directories and add $(srctree)/*.x509 only in such case. However, such fix causes a different issue, namely that a potential $(srctree)/signing_key.x509 appears before the to-be-generated signing_key.x509 in the sorted list, and make remembers this file for the purpose of VPATH search. It worked previously, because ./signing_key.x509 sorts before any absolute path. Solve this by sorting the $(objtree) and $(srctree) files separately, to ensure that signing_key.x509 appears before anything from $(srctree). Signed-off-by: Michal Marek --- kernel/Makefile | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/kernel/Makefile b/kernel/Makefile index 1408b33..792e043 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -117,17 +117,18 @@ $(obj)/config_data.h: $(obj)/config_data.gz FORCE # boot. # # We look in the source root and the build root for all files whose name ends -# in ".x509". Unfortunately, this will generate duplicate filenames, so we -# have make canonicalise the pathnames and then sort them to discard the -# duplicates. +# in ".x509". We put the $(objtree) certificates before those from $(srctree), +# so that a potential signing_key.x509 file from $(srctree) does not take +# precedence. # ############################################################################### ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) -X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509) -X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509 -X509_CERTIFICATES-raw := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \ - $(or $(realpath $(CERT)),$(CERT)))) -X509_CERTIFICATES := $(subst $(realpath $(objtree))/,,$(X509_CERTIFICATES-raw)) +X509_CERTIFICATES-y := $(wildcard *.x509) +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) +ifneq ($(objtree),$(srctree)) +X509_CERTIFICATES += $(sort $(wildcard $(srctree)/*.x509)) +endif ifeq ($(X509_CERTIFICATES),) $(warning *** No X.509 certificates found ***) -- 1.9.2