LinuxLists.cc - [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist

[permalink] [raw]

Subject: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/

This script is only used in certs/Makefile, so certs/ is a better
home for it.

Signed-off-by: Masahiro Yamada <[email protected]>
---

MAINTAINERS | 1 -
certs/Makefile | 2 +-
{scripts => certs}/check-blacklist-hashes.awk | 0
3 files changed, 1 insertion(+), 2 deletions(-)
rename {scripts => certs}/check-blacklist-hashes.awk (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 1fc9ead83d2a..7c2a7c304824 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4627,7 +4627,6 @@ L: [email protected]
S: Maintained
F: Documentation/admin-guide/module-signing.rst
F: certs/
-F: scripts/check-blacklist-hashes.awk
F: scripts/sign-file.c
F: tools/certs/

diff --git a/certs/Makefile b/certs/Makefile
index a8d628fd5f7b..df7aaeafd19c 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)

quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
cmd_check_and_copy_blacklist_hash_list = \
- $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
+ $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@

$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
similarity index 100%
rename from scripts/check-blacklist-hashes.awk
rename to certs/check-blacklist-hashes.awk
--
2.32.0

2022-06-11 20:02:52

[permalink] [raw]

Subject: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
valid") was applied 8 months after the submission.

In the meantime, the base code had been removed by commit b8c96a6b466c
("certs: simplify $(srctree)/ handling and remove config_filename
macro").

Fix the Makefile.

Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
included from certs/blacklist_hashes.c and also works as a timestamp.

Send error messages from check-blacklist-hashes.awk to stderr instead
of stdout.

Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
Signed-off-by: Masahiro Yamada <[email protected]>
---

certs/.gitignore | 2 +-
certs/Makefile | 20 ++++++++++----------
certs/blacklist_hashes.c | 2 +-
3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/certs/.gitignore b/certs/.gitignore
index 56637aceaf81..cec5465f31c1 100644
--- a/certs/.gitignore
+++ b/certs/.gitignore
@@ -1,5 +1,5 @@
# SPDX-License-Identifier: GPL-2.0-only
-/blacklist_hashes_checked
+/blacklist_hash_list
/extract-cert
/x509_certificate_list
/x509_revocation_list
diff --git a/certs/Makefile b/certs/Makefile
index cb1a9da3fc58..a8d628fd5f7b 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
-quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
- cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@

-$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
+$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
+CFLAGS_blacklist_hashes.o := -I $(obj)

-$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
+quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
+ cmd_check_and_copy_blacklist_hash_list = \
+ $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
+ cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@

-CFLAGS_blacklist_hashes.o += -I$(srctree)
-
-targets += blacklist_hashes_checked
-$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
- $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
+$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
+ $(call if_changed,check_and_copy_blacklist_hash_list)
obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
else
obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
endif
+targets += blacklist_hash_list

quiet_cmd_extract_certs = CERT $@
cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
@@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
$(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
$(call if_changed,extract_certs)

-targets += x509_certificate_list blacklist_hashes_checked
+targets += x509_certificate_list

# If module signing is requested, say by allyesconfig, but a key has not been
# supplied, then one will need to be generated to make sure the build does not
diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
index d5961aa3d338..86d66fe11348 100644
--- a/certs/blacklist_hashes.c
+++ b/certs/blacklist_hashes.c
@@ -2,6 +2,6 @@
#include "blacklist.h"

const char __initconst *const blacklist_hashes[] = {
-#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
+#include "blacklist_hash_list"
, NULL
};
--
2.32.0

2022-06-13 16:56:10

[permalink] [raw]

Subject: Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/

On 11/06/2022 19:22, Masahiro Yamada wrote:
> This script is only used in certs/Makefile, so certs/ is a better
> home for it.
>
> Signed-off-by: Masahiro Yamada <[email protected]>
> ---
>
> MAINTAINERS | 1 -
> certs/Makefile | 2 +-
> {scripts => certs}/check-blacklist-hashes.awk | 0
> 3 files changed, 1 insertion(+), 2 deletions(-)
> rename {scripts => certs}/check-blacklist-hashes.awk (100%)
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 1fc9ead83d2a..7c2a7c304824 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -4627,7 +4627,6 @@ L: [email protected]
> S: Maintained
> F: Documentation/admin-guide/module-signing.rst
> F: certs/
> -F: scripts/check-blacklist-hashes.awk > F: scripts/sign-file.c
> F: tools/certs/
>
> diff --git a/certs/Makefile b/certs/Makefile
> index a8d628fd5f7b..df7aaeafd19c 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
>
> quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> cmd_check_and_copy_blacklist_hash_list = \
> - $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> + $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>
> $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
> similarity index 100%
> rename from scripts/check-blacklist-hashes.awk
> rename to certs/check-blacklist-hashes.awk

It looks more appropriate and consistent to me to keep it in scripts/,
close to other cert scripts. Is there some precedent to move such script?

2022-06-13 17:43:08

[permalink] [raw]

Subject: Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

On 11/06/2022 19:22, Masahiro Yamada wrote:
> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> valid") was applied 8 months after the submission.
>
> In the meantime, the base code had been removed by commit b8c96a6b466c
> ("certs: simplify $(srctree)/ handling and remove config_filename
> macro").
>
> Fix the Makefile.
>
> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> included from certs/blacklist_hashes.c and also works as a timestamp.
>
> Send error messages from check-blacklist-hashes.awk to stderr instead
> of stdout.
>
> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> Signed-off-by: Masahiro Yamada <[email protected]>

Reviewed-by: Mickaël Salaün <[email protected]>

As a side note, it may let an orphan certs/blacklist_hashes_checked file
but we can't really do something about that and it's OK.

Thanks!

> ---
>
> certs/.gitignore | 2 +-
> certs/Makefile | 20 ++++++++++----------
> certs/blacklist_hashes.c | 2 +-
> 3 files changed, 12 insertions(+), 12 deletions(-)
>
> diff --git a/certs/.gitignore b/certs/.gitignore
> index 56637aceaf81..cec5465f31c1 100644
> --- a/certs/.gitignore
> +++ b/certs/.gitignore
> @@ -1,5 +1,5 @@
> # SPDX-License-Identifier: GPL-2.0-only
> -/blacklist_hashes_checked
> +/blacklist_hash_list
> /extract-cert
> /x509_certificate_list
> /x509_revocation_list
> diff --git a/certs/Makefile b/certs/Makefile
> index cb1a9da3fc58..a8d628fd5f7b 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
>
> -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> +CFLAGS_blacklist_hashes.o := -I $(obj)
>
> -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> + cmd_check_and_copy_blacklist_hash_list = \
> + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>
> -CFLAGS_blacklist_hashes.o += -I$(srctree)
> -
> -targets += blacklist_hashes_checked
> -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> + $(call if_changed,check_and_copy_blacklist_hash_list)
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> else
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> endif
> +targets += blacklist_hash_list
>
> quiet_cmd_extract_certs = CERT $@
> cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> $(call if_changed,extract_certs)
>
> -targets += x509_certificate_list blacklist_hashes_checked
> +targets += x509_certificate_list
>
> # If module signing is requested, say by allyesconfig, but a key has not been
> # supplied, then one will need to be generated to make sure the build does not
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index d5961aa3d338..86d66fe11348 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -2,6 +2,6 @@
> #include "blacklist.h"
>
> const char __initconst *const blacklist_hashes[] = {
> -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> +#include "blacklist_hash_list"
> , NULL
> };

2022-06-13 17:45:23

[permalink] [raw]

Subject: Re: [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist

On 11/06/2022 19:22, Masahiro Yamada wrote:
> This file fails to compile as follows:
>
> CC certs/blacklist_hashes.o
> certs/blacklist_hashes.c:4:1: error: ignoring attribute ‘section (".init.data")’ because it conflicts with previous ‘section (".init.rodata")’ [-Werror=attributes]
> 4 | const char __initdata *const blacklist_hashes[] = {
> | ^~~~~
> In file included from certs/blacklist_hashes.c:2:
> certs/blacklist.h:5:38: note: previous declaration here
> 5 | extern const char __initconst *const blacklist_hashes[];
> | ^~~~~~~~~~~~~~~~
>
> Apply the same fix as commit 2be04df5668d ("certs/blacklist_nohashes.c:
> fix const confusion in certs blacklist").
>
> Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring")
> Signed-off-by: Masahiro Yamada <[email protected]>

Reviewed-by: Mickaël Salaün <[email protected]>

> ---
>
> certs/blacklist_hashes.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index 344892337be0..d5961aa3d338 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -1,7 +1,7 @@
> // SPDX-License-Identifier: GPL-2.0
> #include "blacklist.h"
>
> -const char __initdata *const blacklist_hashes[] = {
> +const char __initconst *const blacklist_hashes[] = {
> #include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> , NULL
> };

2022-06-13 19:12:26

[permalink] [raw]

Subject: Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <[email protected]> wrote:
>
>
>
> On 11/06/2022 19:22, Masahiro Yamada wrote:
> > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > valid") was applied 8 months after the submission.
> >
> > In the meantime, the base code had been removed by commit b8c96a6b466c
> > ("certs: simplify $(srctree)/ handling and remove config_filename
> > macro").
> >
> > Fix the Makefile.
> >
> > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > included from certs/blacklist_hashes.c and also works as a timestamp.
> >
> > Send error messages from check-blacklist-hashes.awk to stderr instead
> > of stdout.
> >
> > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > Signed-off-by: Masahiro Yamada <[email protected]>
>
> Reviewed-by: Mickaël Salaün <[email protected]>
>
> As a side note, it may let an orphan certs/blacklist_hashes_checked file
> but we can't really do something about that and it's OK.

GNU Make uses timestamps of files for dependency tracking,
so Kbuild keeps all intermediate files.

Keeping certs/blacklist_hashes_checked
is the right thing to do.

> Thanks!
>
> > ---
> >
> > certs/.gitignore | 2 +-
> > certs/Makefile | 20 ++++++++++----------
> > certs/blacklist_hashes.c | 2 +-
> > 3 files changed, 12 insertions(+), 12 deletions(-)
> >
> > diff --git a/certs/.gitignore b/certs/.gitignore
> > index 56637aceaf81..cec5465f31c1 100644
> > --- a/certs/.gitignore
> > +++ b/certs/.gitignore
> > @@ -1,5 +1,5 @@
> > # SPDX-License-Identifier: GPL-2.0-only
> > -/blacklist_hashes_checked
> > +/blacklist_hash_list
> > /extract-cert
> > /x509_certificate_list
> > /x509_revocation_list
> > diff --git a/certs/Makefile b/certs/Makefile
> > index cb1a9da3fc58..a8d628fd5f7b 100644
> > --- a/certs/Makefile
> > +++ b/certs/Makefile
> > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> > - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> >
> > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > +CFLAGS_blacklist_hashes.o := -I $(obj)
> >
> > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > + cmd_check_and_copy_blacklist_hash_list = \
> > + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> >
> > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > -
> > -targets += blacklist_hashes_checked
> > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > + $(call if_changed,check_and_copy_blacklist_hash_list)
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > else
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > endif
> > +targets += blacklist_hash_list
> >
> > quiet_cmd_extract_certs = CERT $@
> > cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > $(call if_changed,extract_certs)
> >
> > -targets += x509_certificate_list blacklist_hashes_checked
> > +targets += x509_certificate_list
> >
> > # If module signing is requested, say by allyesconfig, but a key has not been
> > # supplied, then one will need to be generated to make sure the build does not
> > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > index d5961aa3d338..86d66fe11348 100644
> > --- a/certs/blacklist_hashes.c
> > +++ b/certs/blacklist_hashes.c
> > @@ -2,6 +2,6 @@
> > #include "blacklist.h"
> >
> > const char __initconst *const blacklist_hashes[] = {
> > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > +#include "blacklist_hash_list"
> > , NULL
> > };

--
Best Regards
Masahiro Yamada

2022-06-13 19:14:39

[permalink] [raw]

Subject: Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/

On Mon, Jun 13, 2022 at 9:36 PM Mickaël Salaün <[email protected]> wrote:
>
>
>
> On 11/06/2022 19:22, Masahiro Yamada wrote:
> > This script is only used in certs/Makefile, so certs/ is a better
> > home for it.
> >
> > Signed-off-by: Masahiro Yamada <[email protected]>
> > ---
> >
> > MAINTAINERS | 1 -
> > certs/Makefile | 2 +-
> > {scripts => certs}/check-blacklist-hashes.awk | 0
> > 3 files changed, 1 insertion(+), 2 deletions(-)
> > rename {scripts => certs}/check-blacklist-hashes.awk (100%)
> >
> > diff --git a/MAINTAINERS b/MAINTAINERS
> > index 1fc9ead83d2a..7c2a7c304824 100644
> > --- a/MAINTAINERS
> > +++ b/MAINTAINERS
> > @@ -4627,7 +4627,6 @@ L: [email protected]
> > S: Maintained
> > F: Documentation/admin-guide/module-signing.rst
> > F: certs/
> > -F: scripts/check-blacklist-hashes.awk > F: scripts/sign-file.c
> > F: tools/certs/
> >
> > diff --git a/certs/Makefile b/certs/Makefile
> > index a8d628fd5f7b..df7aaeafd19c 100644
> > --- a/certs/Makefile
> > +++ b/certs/Makefile
> > @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
> >
> > quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > cmd_check_and_copy_blacklist_hash_list = \
> > - $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > + $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> >
> > $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
> > similarity index 100%
> > rename from scripts/check-blacklist-hashes.awk
> > rename to certs/check-blacklist-hashes.awk
>
> It looks more appropriate and consistent to me to keep it in scripts/,
> close to other cert scripts. Is there some precedent to move such script?

I always did that. For example,

f6f57a46435d7253a52a1a07a58183678ad266a0
78a20a012ecea857e438b1f9e8091acb290bd0f5
28ba53c07638f31b153e3a32672a6124d0ff2a97
4484aa800ac588a1fe2175cd53076c21067f44b4
340a02535ee785c64c62a9c45706597a0139e972

Tools can stay in scripts/ if and only if:

- it is used globally during kernel builds

- it is still needed after the kernel builds.
"make clean" removes most of the build artifacts
but keeps ones under scripts/.

scripts/insert-sys-cert is apparently unneeded for building the kernel.
If the intended use is to manipulate vmlinux later,
that is the legitimate reason to stay in scripts/.
(but even better place might be tools/)

certs/signing_key.pem is needed even after kernel builds.
So, it should have been kept under scripts/ instead of certs/.

--
Best Regards
Masahiro Yamada

2022-06-13 20:08:31

[permalink] [raw]

Subject: Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

On 13/06/2022 16:55, Masahiro Yamada wrote:
> On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <[email protected]> wrote:
>>
>>
>>
>> On 11/06/2022 19:22, Masahiro Yamada wrote:
>>> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
>>> valid") was applied 8 months after the submission.
>>>
>>> In the meantime, the base code had been removed by commit b8c96a6b466c
>>> ("certs: simplify $(srctree)/ handling and remove config_filename
>>> macro").
>>>
>>> Fix the Makefile.
>>>
>>> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
>>> included from certs/blacklist_hashes.c and also works as a timestamp.
>>>
>>> Send error messages from check-blacklist-hashes.awk to stderr instead
>>> of stdout.
>>>
>>> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
>>> Signed-off-by: Masahiro Yamada <[email protected]>
>>
>> Reviewed-by: Mickaël Salaün <[email protected]>
>>
>> As a side note, it may let an orphan certs/blacklist_hashes_checked file
>> but we can't really do something about that and it's OK.
>
>
> GNU Make uses timestamps of files for dependency tracking,
> so Kbuild keeps all intermediate files.
>
> Keeping certs/blacklist_hashes_checked
> is the right thing to do.

blacklist_hashes_checked is the file you replaced with
blacklist_hash_list, and is then not used in any Makefile anymore. There
is then no timestamp issue. I just wanted to mention that it is normal
that a git status will show it on build directories also used as source
directories that were already using such feature.

>
>
>
>> Thanks!
>>
>>> ---
>>>
>>> certs/.gitignore | 2 +-
>>> certs/Makefile | 20 ++++++++++----------
>>> certs/blacklist_hashes.c | 2 +-
>>> 3 files changed, 12 insertions(+), 12 deletions(-)
>>>
>>> diff --git a/certs/.gitignore b/certs/.gitignore
>>> index 56637aceaf81..cec5465f31c1 100644
>>> --- a/certs/.gitignore
>>> +++ b/certs/.gitignore
>>> @@ -1,5 +1,5 @@
>>> # SPDX-License-Identifier: GPL-2.0-only
>>> -/blacklist_hashes_checked
>>> +/blacklist_hash_list
>>> /extract-cert
>>> /x509_certificate_list
>>> /x509_revocation_list
>>> diff --git a/certs/Makefile b/certs/Makefile
>>> index cb1a9da3fc58..a8d628fd5f7b 100644
>>> --- a/certs/Makefile
>>> +++ b/certs/Makefile
>>> @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
>>> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
>>> obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
>>> ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
>>> -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
>>> - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
>>>
>>> -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
>>> +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
>>> +CFLAGS_blacklist_hashes.o := -I $(obj)
>>>
>>> -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
>>> +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
>>> + cmd_check_and_copy_blacklist_hash_list = \
>>> + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>>> + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>>>
>>> -CFLAGS_blacklist_hashes.o += -I$(srctree)
>>> -
>>> -targets += blacklist_hashes_checked
>>> -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
>>> - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
>>> +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
>>> + $(call if_changed,check_and_copy_blacklist_hash_list)
>>> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
>>> else
>>> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
>>> endif
>>> +targets += blacklist_hash_list
>>>
>>> quiet_cmd_extract_certs = CERT $@
>>> cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
>>> @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
>>> $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
>>> $(call if_changed,extract_certs)
>>>
>>> -targets += x509_certificate_list blacklist_hashes_checked
>>> +targets += x509_certificate_list
>>>
>>> # If module signing is requested, say by allyesconfig, but a key has not been
>>> # supplied, then one will need to be generated to make sure the build does not
>>> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
>>> index d5961aa3d338..86d66fe11348 100644
>>> --- a/certs/blacklist_hashes.c
>>> +++ b/certs/blacklist_hashes.c
>>> @@ -2,6 +2,6 @@
>>> #include "blacklist.h"
>>>
>>> const char __initconst *const blacklist_hashes[] = {
>>> -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
>>> +#include "blacklist_hash_list"
>>> , NULL
>>> };
>
>
>
> --
> Best Regards
> Masahiro Yamada

2022-06-13 20:32:26

[permalink] [raw]

Subject: Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/

On 13/06/2022 17:28, Masahiro Yamada wrote:
> On Mon, Jun 13, 2022 at 9:36 PM Mickaël Salaün <[email protected]> wrote:
>>
>>
>>
>> On 11/06/2022 19:22, Masahiro Yamada wrote:
>>> This script is only used in certs/Makefile, so certs/ is a better
>>> home for it.
>>>
>>> Signed-off-by: Masahiro Yamada <[email protected]>
>>> ---
>>>
>>> MAINTAINERS | 1 -
>>> certs/Makefile | 2 +-
>>> {scripts => certs}/check-blacklist-hashes.awk | 0
>>> 3 files changed, 1 insertion(+), 2 deletions(-)
>>> rename {scripts => certs}/check-blacklist-hashes.awk (100%)
>>>
>>> diff --git a/MAINTAINERS b/MAINTAINERS
>>> index 1fc9ead83d2a..7c2a7c304824 100644
>>> --- a/MAINTAINERS
>>> +++ b/MAINTAINERS
>>> @@ -4627,7 +4627,6 @@ L: [email protected]
>>> S: Maintained
>>> F: Documentation/admin-guide/module-signing.rst
>>> F: certs/
>>> -F: scripts/check-blacklist-hashes.awk > F: scripts/sign-file.c
>>> F: tools/certs/
>>>
>>> diff --git a/certs/Makefile b/certs/Makefile
>>> index a8d628fd5f7b..df7aaeafd19c 100644
>>> --- a/certs/Makefile
>>> +++ b/certs/Makefile
>>> @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
>>>
>>> quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
>>> cmd_check_and_copy_blacklist_hash_list = \
>>> - $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>>> + $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
>>> cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>>>
>>> $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
>>> diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
>>> similarity index 100%
>>> rename from scripts/check-blacklist-hashes.awk
>>> rename to certs/check-blacklist-hashes.awk
>>
>> It looks more appropriate and consistent to me to keep it in scripts/,
>> close to other cert scripts. Is there some precedent to move such script?
>
>
> I always did that. For example,
>
> f6f57a46435d7253a52a1a07a58183678ad266a0
> 78a20a012ecea857e438b1f9e8091acb290bd0f5
> 28ba53c07638f31b153e3a32672a6124d0ff2a97
> 4484aa800ac588a1fe2175cd53076c21067f44b4
> 340a02535ee785c64c62a9c45706597a0139e972
>
>
> Tools can stay in scripts/ if and only if:
>
> - it is used globally during kernel builds
>
> - it is still needed after the kernel builds.
> "make clean" removes most of the build artifacts
> but keeps ones under scripts/.
>

OK, it would be nice to have these rules in the documentation (didn't
find them).

Reviewed-by: Mickaël Salaün <[email protected]>

>
>
> scripts/insert-sys-cert is apparently unneeded for building the kernel.
> If the intended use is to manipulate vmlinux later,
> that is the legitimate reason to stay in scripts/.
> (but even better place might be tools/)
>
>
> certs/signing_key.pem is needed even after kernel builds.
> So, it should have been kept under scripts/ instead of certs/.
>
>
>
>
>
> --
> Best Regards
> Masahiro Yamada

2022-06-13 20:35:08

[permalink] [raw]

Subject: Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

On Tue, Jun 14, 2022 at 3:06 AM Mickaël Salaün <[email protected]> wrote:
>
>
> On 13/06/2022 16:55, Masahiro Yamada wrote:
> > On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <[email protected]> wrote:
> >>
> >>
> >>
> >> On 11/06/2022 19:22, Masahiro Yamada wrote:
> >>> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> >>> valid") was applied 8 months after the submission.
> >>>
> >>> In the meantime, the base code had been removed by commit b8c96a6b466c
> >>> ("certs: simplify $(srctree)/ handling and remove config_filename
> >>> macro").
> >>>
> >>> Fix the Makefile.
> >>>
> >>> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> >>> included from certs/blacklist_hashes.c and also works as a timestamp.
> >>>
> >>> Send error messages from check-blacklist-hashes.awk to stderr instead
> >>> of stdout.
> >>>
> >>> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> >>> Signed-off-by: Masahiro Yamada <[email protected]>
> >>
> >> Reviewed-by: Mickaël Salaün <[email protected]>
> >>
> >> As a side note, it may let an orphan certs/blacklist_hashes_checked file
> >> but we can't really do something about that and it's OK.
> >
> >
> > GNU Make uses timestamps of files for dependency tracking,
> > so Kbuild keeps all intermediate files.
> >
> > Keeping certs/blacklist_hashes_checked
> > is the right thing to do.
>
> blacklist_hashes_checked is the file you replaced with
> blacklist_hash_list, and is then not used in any Makefile anymore. There
> is then no timestamp issue. I just wanted to mention that it is normal
> that a git status will show it on build directories also used as source
> directories that were already using such feature.

Ah, sorry, I misunderstood your feedback.

If 'git status' is your concern,
we can add certs/blacklist_hashes_checked
to scripts/remove-stale-files.

addf466389d9d78f255e8b15ac44ab4791029852
was merged into mainline just recently, and
not contained in any release.

But, if the orphan timestamp matters, I will do it.
It is just a one-liner addition.

--
Best Regards
Masahiro Yamada

2022-06-13 20:35:27

[permalink] [raw]

Subject: Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

On 13/06/2022 20:56, Masahiro Yamada wrote:
> On Tue, Jun 14, 2022 at 3:06 AM Mickaël Salaün <[email protected]> wrote:
>>
>>
>> On 13/06/2022 16:55, Masahiro Yamada wrote:
>>> On Mon, Jun 13, 2022 at 9:34 PM Mickaël Salaün <[email protected]> wrote:
>>>>
>>>>
>>>>
>>>> On 11/06/2022 19:22, Masahiro Yamada wrote:
>>>>> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
>>>>> valid") was applied 8 months after the submission.
>>>>>
>>>>> In the meantime, the base code had been removed by commit b8c96a6b466c
>>>>> ("certs: simplify $(srctree)/ handling and remove config_filename
>>>>> macro").
>>>>>
>>>>> Fix the Makefile.
>>>>>
>>>>> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
>>>>> included from certs/blacklist_hashes.c and also works as a timestamp.
>>>>>
>>>>> Send error messages from check-blacklist-hashes.awk to stderr instead
>>>>> of stdout.
>>>>>
>>>>> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
>>>>> Signed-off-by: Masahiro Yamada <[email protected]>
>>>>
>>>> Reviewed-by: Mickaël Salaün <[email protected]>
>>>>
>>>> As a side note, it may let an orphan certs/blacklist_hashes_checked file
>>>> but we can't really do something about that and it's OK.
>>>
>>>
>>> GNU Make uses timestamps of files for dependency tracking,
>>> so Kbuild keeps all intermediate files.
>>>
>>> Keeping certs/blacklist_hashes_checked
>>> is the right thing to do.
>>
>> blacklist_hashes_checked is the file you replaced with
>> blacklist_hash_list, and is then not used in any Makefile anymore. There
>> is then no timestamp issue. I just wanted to mention that it is normal
>> that a git status will show it on build directories also used as source
>> directories that were already using such feature.
>
>
> Ah, sorry, I misunderstood your feedback.
>
> If 'git status' is your concern,
> we can add certs/blacklist_hashes_checked
> to scripts/remove-stale-files.
>
> addf466389d9d78f255e8b15ac44ab4791029852
> was merged into mainline just recently, and
> not contained in any release.

Indeed, it's all good then.

>
> But, if the orphan timestamp matters, I will do it.
> It is just a one-liner addition.

2022-06-15 18:51:06

[permalink] [raw]

Subject: Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/

On Sun, Jun 12, 2022 at 02:22:32AM +0900, Masahiro Yamada wrote:
> This script is only used in certs/Makefile, so certs/ is a better
> home for it.
>
> Signed-off-by: Masahiro Yamada <[email protected]>
> ---
>
> MAINTAINERS | 1 -
> certs/Makefile | 2 +-
> {scripts => certs}/check-blacklist-hashes.awk | 0
> 3 files changed, 1 insertion(+), 2 deletions(-)
> rename {scripts => certs}/check-blacklist-hashes.awk (100%)
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 1fc9ead83d2a..7c2a7c304824 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -4627,7 +4627,6 @@ L: [email protected]
> S: Maintained
> F: Documentation/admin-guide/module-signing.rst
> F: certs/
> -F: scripts/check-blacklist-hashes.awk
> F: scripts/sign-file.c
> F: tools/certs/
>
> diff --git a/certs/Makefile b/certs/Makefile
> index a8d628fd5f7b..df7aaeafd19c 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o := -I $(obj)
>
> quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> cmd_check_and_copy_blacklist_hash_list = \
> - $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> + $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>
> $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist-hashes.awk
> similarity index 100%
> rename from scripts/check-blacklist-hashes.awk
> rename to certs/check-blacklist-hashes.awk
> --
> 2.32.0
>

Reviewed-by: Jarkko Sakkinen <[email protected]>

BR, Jarkko

2022-06-15 19:22:33

[permalink] [raw]

Subject: Re: [PATCH 1/4] certs/blacklist_hashes.c: fix const confusion in certs blacklist

On Sun, Jun 12, 2022 at 02:22:30AM +0900, Masahiro Yamada wrote:
> This file fails to compile as follows:
>
> CC certs/blacklist_hashes.o
> certs/blacklist_hashes.c:4:1: error: ignoring attribute ‘section (".init.data")’ because it conflicts with previous ‘section (".init.rodata")’ [-Werror=attributes]
> 4 | const char __initdata *const blacklist_hashes[] = {
> | ^~~~~
> In file included from certs/blacklist_hashes.c:2:
> certs/blacklist.h:5:38: note: previous declaration here
> 5 | extern const char __initconst *const blacklist_hashes[];
> | ^~~~~~~~~~~~~~~~
>
> Apply the same fix as commit 2be04df5668d ("certs/blacklist_nohashes.c:
> fix const confusion in certs blacklist").
>
> Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring")
> Signed-off-by: Masahiro Yamada <[email protected]>
> ---
>
> certs/blacklist_hashes.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index 344892337be0..d5961aa3d338 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -1,7 +1,7 @@
> // SPDX-License-Identifier: GPL-2.0
> #include "blacklist.h"
>
> -const char __initdata *const blacklist_hashes[] = {
> +const char __initconst *const blacklist_hashes[] = {
> #include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> , NULL
> };
> --
> 2.32.0
>

Reviewed-by: Jarkko Sakkinen <[email protected]>

BR, Jarkko

2022-06-15 19:34:25

[permalink] [raw]

Subject: Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

On Mon, Jun 13, 2022 at 02:34:36PM +0200, Micka?l Sala?n wrote:
>
>
> On 11/06/2022 19:22, Masahiro Yamada wrote:
> > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > valid") was applied 8 months after the submission.
> >
> > In the meantime, the base code had been removed by commit b8c96a6b466c
> > ("certs: simplify $(srctree)/ handling and remove config_filename
> > macro").
> >
> > Fix the Makefile.
> >
> > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > included from certs/blacklist_hashes.c and also works as a timestamp.
> >
> > Send error messages from check-blacklist-hashes.awk to stderr instead
> > of stdout.
> >
> > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > Signed-off-by: Masahiro Yamada <[email protected]>
>
> Reviewed-by: Micka?l Sala?n <[email protected]>
>
> As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> we can't really do something about that and it's OK.
>
> Thanks!
>
> > ---
> >
> > certs/.gitignore | 2 +-
> > certs/Makefile | 20 ++++++++++----------
> > certs/blacklist_hashes.c | 2 +-
> > 3 files changed, 12 insertions(+), 12 deletions(-)
> >
> > diff --git a/certs/.gitignore b/certs/.gitignore
> > index 56637aceaf81..cec5465f31c1 100644
> > --- a/certs/.gitignore
> > +++ b/certs/.gitignore
> > @@ -1,5 +1,5 @@
> > # SPDX-License-Identifier: GPL-2.0-only
> > -/blacklist_hashes_checked
> > +/blacklist_hash_list
> > /extract-cert
> > /x509_certificate_list
> > /x509_revocation_list
> > diff --git a/certs/Makefile b/certs/Makefile
> > index cb1a9da3fc58..a8d628fd5f7b 100644
> > --- a/certs/Makefile
> > +++ b/certs/Makefile
> > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> > - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > + cmd_check_and_copy_blacklist_hash_list = \
> > + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > -
> > -targets += blacklist_hashes_checked
> > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > + $(call if_changed,check_and_copy_blacklist_hash_list)
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > else
> > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > endif
> > +targets += blacklist_hash_list
> > quiet_cmd_extract_certs = CERT $@
> > cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > $(call if_changed,extract_certs)
> > -targets += x509_certificate_list blacklist_hashes_checked
> > +targets += x509_certificate_list
> > # If module signing is requested, say by allyesconfig, but a key has not been
> > # supplied, then one will need to be generated to make sure the build does not
> > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > index d5961aa3d338..86d66fe11348 100644
> > --- a/certs/blacklist_hashes.c
> > +++ b/certs/blacklist_hashes.c
> > @@ -2,6 +2,6 @@
> > #include "blacklist.h"
> > const char __initconst *const blacklist_hashes[] = {
> > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > +#include "blacklist_hash_list"
> > , NULL
> > };

I'll make a PR for 1/4 and 2/4 so that they get into 5.19.

BR, Jarkko

2022-06-15 19:34:53

[permalink] [raw]

Subject: Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

On Sun, Jun 12, 2022 at 02:22:31AM +0900, Masahiro Yamada wrote:
> Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> valid") was applied 8 months after the submission.
>
> In the meantime, the base code had been removed by commit b8c96a6b466c
> ("certs: simplify $(srctree)/ handling and remove config_filename
> macro").
>
> Fix the Makefile.
>
> Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> included from certs/blacklist_hashes.c and also works as a timestamp.
>
> Send error messages from check-blacklist-hashes.awk to stderr instead
> of stdout.
>
> Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> Signed-off-by: Masahiro Yamada <[email protected]>
> ---
>
> certs/.gitignore | 2 +-
> certs/Makefile | 20 ++++++++++----------
> certs/blacklist_hashes.c | 2 +-
> 3 files changed, 12 insertions(+), 12 deletions(-)
>
> diff --git a/certs/.gitignore b/certs/.gitignore
> index 56637aceaf81..cec5465f31c1 100644
> --- a/certs/.gitignore
> +++ b/certs/.gitignore
> @@ -1,5 +1,5 @@
> # SPDX-License-Identifier: GPL-2.0-only
> -/blacklist_hashes_checked
> +/blacklist_hash_list
> /extract-cert
> /x509_certificate_list
> /x509_revocation_list
> diff --git a/certs/Makefile b/certs/Makefile
> index cb1a9da3fc58..a8d628fd5f7b 100644
> --- a/certs/Makefile
> +++ b/certs/Makefile
> @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
>
> -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> +CFLAGS_blacklist_hashes.o := -I $(obj)
>
> -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> + cmd_check_and_copy_blacklist_hash_list = \
> + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
>
> -CFLAGS_blacklist_hashes.o += -I$(srctree)
> -
> -targets += blacklist_hashes_checked
> -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> + $(call if_changed,check_and_copy_blacklist_hash_list)
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> else
> obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> endif
> +targets += blacklist_hash_list
>
> quiet_cmd_extract_certs = CERT $@
> cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> $(call if_changed,extract_certs)
>
> -targets += x509_certificate_list blacklist_hashes_checked
> +targets += x509_certificate_list
>
> # If module signing is requested, say by allyesconfig, but a key has not been
> # supplied, then one will need to be generated to make sure the build does not
> diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> index d5961aa3d338..86d66fe11348 100644
> --- a/certs/blacklist_hashes.c
> +++ b/certs/blacklist_hashes.c
> @@ -2,6 +2,6 @@
> #include "blacklist.h"
>
> const char __initconst *const blacklist_hashes[] = {
> -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> +#include "blacklist_hash_list"
> , NULL
> };
> --
> 2.32.0
>

Reviewed-by: Jarkko Sakkinen <[email protected]>

BR, Jarkko

2022-06-18 22:24:12

[permalink] [raw]

Subject: Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

On Thu, Jun 16, 2022 at 3:51 AM Jarkko Sakkinen <[email protected]> wrote:
>
> On Mon, Jun 13, 2022 at 02:34:36PM +0200, Mickaël Salaün wrote:
> >
> >
> > On 11/06/2022 19:22, Masahiro Yamada wrote:
> > > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > > valid") was applied 8 months after the submission.
> > >
> > > In the meantime, the base code had been removed by commit b8c96a6b466c
> > > ("certs: simplify $(srctree)/ handling and remove config_filename
> > > macro").
> > >
> > > Fix the Makefile.
> > >
> > > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > > included from certs/blacklist_hashes.c and also works as a timestamp.
> > >
> > > Send error messages from check-blacklist-hashes.awk to stderr instead
> > > of stdout.
> > >
> > > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > > Signed-off-by: Masahiro Yamada <[email protected]>
> >
> > Reviewed-by: Mickaël Salaün <[email protected]>
> >
> > As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> > we can't really do something about that and it's OK.
> >
> > Thanks!
> >
> > > ---
> > >
> > > certs/.gitignore | 2 +-
> > > certs/Makefile | 20 ++++++++++----------
> > > certs/blacklist_hashes.c | 2 +-
> > > 3 files changed, 12 insertions(+), 12 deletions(-)
> > >
> > > diff --git a/certs/.gitignore b/certs/.gitignore
> > > index 56637aceaf81..cec5465f31c1 100644
> > > --- a/certs/.gitignore
> > > +++ b/certs/.gitignore
> > > @@ -1,5 +1,5 @@
> > > # SPDX-License-Identifier: GPL-2.0-only
> > > -/blacklist_hashes_checked
> > > +/blacklist_hash_list
> > > /extract-cert
> > > /x509_certificate_list
> > > /x509_revocation_list
> > > diff --git a/certs/Makefile b/certs/Makefile
> > > index cb1a9da3fc58..a8d628fd5f7b 100644
> > > --- a/certs/Makefile
> > > +++ b/certs/Makefile
> > > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > > obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > > ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > > -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> > > - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > > + cmd_check_and_copy_blacklist_hash_list = \
> > > + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > > + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > > -
> > > -targets += blacklist_hashes_checked
> > > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > > - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > > + $(call if_changed,check_and_copy_blacklist_hash_list)
> > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > > else
> > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > > endif
> > > +targets += blacklist_hash_list
> > > quiet_cmd_extract_certs = CERT $@
> > > cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> > > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > > $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > > $(call if_changed,extract_certs)
> > > -targets += x509_certificate_list blacklist_hashes_checked
> > > +targets += x509_certificate_list
> > > # If module signing is requested, say by allyesconfig, but a key has not been
> > > # supplied, then one will need to be generated to make sure the build does not
> > > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > > index d5961aa3d338..86d66fe11348 100644
> > > --- a/certs/blacklist_hashes.c
> > > +++ b/certs/blacklist_hashes.c
> > > @@ -2,6 +2,6 @@
> > > #include "blacklist.h"
> > > const char __initconst *const blacklist_hashes[] = {
> > > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > > +#include "blacklist_hash_list"
> > > , NULL
> > > };
>
> I'll make a PR for 1/4 and 2/4 so that they get into 5.19.
>
> BR, Jarkko

Thank you!

What shall we do for 3/4 and 4/4?

Do you have a plan to queue them up for the next MW?

Or, shall I apply them to my kbuild tree with your reivewed-by?

--
Best Regards
Masahiro Yamada

2022-06-26 06:44:38

[permalink] [raw]

Subject: Re: [PATCH 2/4] certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

On Sun, Jun 19, 2022 at 07:12:31AM +0900, Masahiro Yamada wrote:
> On Thu, Jun 16, 2022 at 3:51 AM Jarkko Sakkinen <[email protected]> wrote:
> >
> > On Mon, Jun 13, 2022 at 02:34:36PM +0200, Micka?l Sala?n wrote:
> > >
> > >
> > > On 11/06/2022 19:22, Masahiro Yamada wrote:
> > > > Commit addf466389d9 ("certs: Check that builtin blacklist hashes are
> > > > valid") was applied 8 months after the submission.
> > > >
> > > > In the meantime, the base code had been removed by commit b8c96a6b466c
> > > > ("certs: simplify $(srctree)/ handling and remove config_filename
> > > > macro").
> > > >
> > > > Fix the Makefile.
> > > >
> > > > Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is
> > > > included from certs/blacklist_hashes.c and also works as a timestamp.
> > > >
> > > > Send error messages from check-blacklist-hashes.awk to stderr instead
> > > > of stdout.
> > > >
> > > > Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")
> > > > Signed-off-by: Masahiro Yamada <[email protected]>
> > >
> > > Reviewed-by: Micka?l Sala?n <[email protected]>
> > >
> > > As a side note, it may let an orphan certs/blacklist_hashes_checked file but
> > > we can't really do something about that and it's OK.
> > >
> > > Thanks!
> > >
> > > > ---
> > > >
> > > > certs/.gitignore | 2 +-
> > > > certs/Makefile | 20 ++++++++++----------
> > > > certs/blacklist_hashes.c | 2 +-
> > > > 3 files changed, 12 insertions(+), 12 deletions(-)
> > > >
> > > > diff --git a/certs/.gitignore b/certs/.gitignore
> > > > index 56637aceaf81..cec5465f31c1 100644
> > > > --- a/certs/.gitignore
> > > > +++ b/certs/.gitignore
> > > > @@ -1,5 +1,5 @@
> > > > # SPDX-License-Identifier: GPL-2.0-only
> > > > -/blacklist_hashes_checked
> > > > +/blacklist_hash_list
> > > > /extract-cert
> > > > /x509_certificate_list
> > > > /x509_revocation_list
> > > > diff --git a/certs/Makefile b/certs/Makefile
> > > > index cb1a9da3fc58..a8d628fd5f7b 100644
> > > > --- a/certs/Makefile
> > > > +++ b/certs/Makefile
> > > > @@ -7,22 +7,22 @@ obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o c
> > > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
> > > > obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
> > > > ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),)
> > > > -quiet_cmd_check_blacklist_hashes = CHECK $(patsubst "%",%,$(2))
> > > > - cmd_check_blacklist_hashes = $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(2); touch $@
> > > > -$(eval $(call config_filename,SYSTEM_BLACKLIST_HASH_LIST))
> > > > +$(obj)/blacklist_hashes.o: $(obj)/blacklist_hash_list
> > > > +CFLAGS_blacklist_hashes.o := -I $(obj)
> > > > -$(obj)/blacklist_hashes.o: $(obj)/blacklist_hashes_checked
> > > > +quiet_cmd_check_and_copy_blacklist_hash_list = GEN $@
> > > > + cmd_check_and_copy_blacklist_hash_list = \
> > > > + $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > > > + cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> > > > -CFLAGS_blacklist_hashes.o += -I$(srctree)
> > > > -
> > > > -targets += blacklist_hashes_checked
> > > > -$(obj)/blacklist_hashes_checked: $(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(SYSTEM_BLACKLIST_HASH_LIST_FILENAME) scripts/check-blacklist-hashes.awk FORCE
> > > > - $(call if_changed,check_blacklist_hashes,$(SYSTEM_BLACKLIST_HASH_LIST_SRCPREFIX)$(CONFIG_SYSTEM_BLACKLIST_HASH_LIST))
> > > > +$(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
> > > > + $(call if_changed,check_and_copy_blacklist_hash_list)
> > > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
> > > > else
> > > > obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
> > > > endif
> > > > +targets += blacklist_hash_list
> > > > quiet_cmd_extract_certs = CERT $@
> > > > cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
> > > > @@ -33,7 +33,7 @@ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
> > > > $(obj)/x509_certificate_list: $(CONFIG_SYSTEM_TRUSTED_KEYS) $(obj)/extract-cert FORCE
> > > > $(call if_changed,extract_certs)
> > > > -targets += x509_certificate_list blacklist_hashes_checked
> > > > +targets += x509_certificate_list
> > > > # If module signing is requested, say by allyesconfig, but a key has not been
> > > > # supplied, then one will need to be generated to make sure the build does not
> > > > diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
> > > > index d5961aa3d338..86d66fe11348 100644
> > > > --- a/certs/blacklist_hashes.c
> > > > +++ b/certs/blacklist_hashes.c
> > > > @@ -2,6 +2,6 @@
> > > > #include "blacklist.h"
> > > > const char __initconst *const blacklist_hashes[] = {
> > > > -#include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
> > > > +#include "blacklist_hash_list"
> > > > , NULL
> > > > };
> >
> > I'll make a PR for 1/4 and 2/4 so that they get into 5.19.
> >
> > BR, Jarkko
>
>
> Thank you!
>
> What shall we do for 3/4 and 4/4?
>
> Do you have a plan to queue them up for the next MW?
>
> Or, shall I apply them to my kbuild tree with your reivewed-by?

If possible, please do, thank you for taking the trouble.

BR, Jarkko

2022-06-27 01:41:23