Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 10 Feb 2021 08:01:30 +0000
User-Agent: K-9 Mail for Android
In-Reply-To: <20210210074554.81100-1-songyang@linux.alibaba.com>
References: <20210210074554.81100-1-songyang@linux.alibaba.com>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PATCH] sign-file: add openssl engine support
To:     Yang Song <songyang@linux.alibaba.com>, dhowells@redhat.com,
        keyrings@vger.kernel.org, linux-kernel@vger.kernel.org
CC:     zhang.jia@linux.alibaba.com, tianjia.zhang@linux.alibaba.com,
        songyang@linux.alibaba.com
From:   David Woodhouse <dwmw2@infradead.org>
Message-ID: <E4E1860E-57B8-44AA-B370-9589F9C20215@infradead.org>
Precedence: bulk


On 10 February 2021 07:45:54 GMT, Yang Song <songyang@linux=2Ealibaba=2Eco=
m> wrote:
>Use a customized signature service supported by openssl engine
>to sign the kernel module=2E
>Add command line parameters that support engine for sign-file
>to use the customized openssl engine service to sign kernel modules=2E
>
>Signed-off-by: Yang Song <songyang@linux=2Ealibaba=2Ecom>

Aren't engines already obsolete in the latest versions of OpenSSL, as well=
 as being an implementation detail of one particular crypto library? They a=
ren't really a concept we should be exposing in *our* user interface=2E

Better to make sign-file automatically recognise RFC7512 PKCS#11 URIs and =
handle them by automatically loading the PKCS#11 engine=2E

--=20
Sent from my Android device with K-9 Mail=2E Please excuse my brevity=2E