Explicit check for existing X.509 module signing keypair

RFC PATCH In review Abelardo Ricart III 2 participants 3 messages Apr 10, 2015 – Apr 24, 2015 Kbuild

Share & tools

Abelardo Ricart III

author

2015-04-10 00:37 UTC #0 lore raw

RFC PATCH v2 1/1 Explicit check for existing X.509 module signing keypair

The module-signing.txt documentation states that the kernel will use an existing x.509 key pair for module signing should they exist in the root of the source tree. However, user provided signing keys are unexpectedly overwritten during build if the last-modified times on the key pair are older than the "x509.genkey" target dependency. This fix stops this unexpected behavior, and warns if the key pair was not found.

Signed-off-by Abelardo Ricart III <[email protected]>

---

kernel/Makefile +2 -1

index 1408b33..10c8df0 100644
@@ -168,7 +168,8 @@ ifndef CONFIG_MODULE_SIG_HASH
 $(error Could not determine digest type to use from kernel config)
 endif
 
-signing_key.priv signing_key.x509: x509.genkey
+signing_key.priv signing_key.x509: | x509.genkey
+       $(warning *** X.509 module signing key pair not found in root of source tree ***)
        @echo "###"
        @echo "### Now generating an X.509 key pair to be used for signing modules."
        @echo "###"

Michal Marek

2015-04-13 13:16 UTC #1 lore raw

Added David Howels and [email protected] to Cc

Michal

Quoted 25 lines · Abelardo Ricart III

The module-signing.txt documentation states that the kernel will use an existing x.509 key pair for module signing should they exist in the root of the source tree. However, user provided signing keys are unexpectedly overwritten during build if the last-modified times on the key pair are older than the "x509.genkey" target dependency. This fix stops this unexpected behavior, and warns if the key pair was not found.
Signed-off-by Abelardo Ricart III <[email protected]>
---
kernel/Makefile +2 -1
index 1408b33..10c8df0 100644
@@ -168,7 +168,8 @@ ifndef CONFIG_MODULE_SIG_HASH
 $(error Could not determine digest type to use from kernel config)
 endif
 
-signing_key.priv signing_key.x509: x509.genkey
+signing_key.priv signing_key.x509: | x509.genkey
+       $(warning *** X.509 module signing key pair not found in root of source tree ***)
        @echo "###"
        @echo "### Now generating an X.509 key pair to be used for signing modules."
        @echo "###"

Abelardo Ricart III

author

2015-04-24 23:04 UTC #2 lore raw

What's the word on this?

Quoted 42 lines · Michal Marek

Added David Howels and [email protected] to Cc
Michal
Quoted 30 lines · Abelardo Ricart III
The module-signing.txt documentation states that the kernel will use an existing
x.509 key pair for module signing should they exist in the root of the source tree.
However, user provided signing keys are unexpectedly overwritten during build if the
last-modified times on the key pair are older than the "x509.genkey" target dependency.
This fix stops this unexpected behavior, and warns if the key pair was not found.
Signed-off-by Abelardo Ricart III <[email protected]>
---
kernel/Makefile +2 -1
index 1408b33..10c8df0 100644
@@ -168,7 +168,8 @@ ifndef CONFIG_MODULE_SIG_HASH
 $(error Could not determine digest type to use from kernel config)
 endif
 
-signing_key.priv signing_key.x509: x509.genkey
+signing_key.priv signing_key.x509: | x509.genkey
+       $(warning *** X.509 module signing key pair not found in root of 
 source tree ***)
        @echo "###"
        @echo "### Now generating an X.509 key pair to be used for signing 
modules."
Quoted 2 lines
        @echo "###"
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html