Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220611172233.1494073-1-masahiroy@kernel.org>
 <20220611172233.1494073-3-masahiroy@kernel.org> <e7850717-dad6-daef-c96c-2a74248e98f6@digikod.net>
In-Reply-To: <e7850717-dad6-daef-c96c-2a74248e98f6@digikod.net>
From:   Masahiro Yamada <masahiroy@kernel.org>
Date:   Tue, 14 Jun 2022 00:28:34 +0900
Message-ID: <CAK7LNASR6Hwj-Q+z6GCGTOz0gXv5XXTV8phqe7duGm+uuo3eDQ@mail.gmail.com>
Subject: Re: [PATCH 3/4] certs: move scripts/check-blacklist-hashes.awk to certs/
To:     =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= <mic@digikod.net>
Cc:     Linux Kbuild mailing list <linux-kbuild@vger.kernel.org>,
        David Howells <dhowells@redhat.com>,
        Jarkko Sakkinen <jarkko@kernel.org>,
        David Woodhouse <dwmw2@infradead.org>,
        keyrings@vger.kernel.org,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Eric Snowberg <eric.snowberg@oracle.com>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        Tyler Hicks <tyhicks@linux.microsoft.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, Jun 13, 2022 at 9:36 PM Micka=C3=ABl Sala=C3=BCn <mic@digikod.net> =
wrote:
>
>
>
> On 11/06/2022 19:22, Masahiro Yamada wrote:
> > This script is only used in certs/Makefile, so certs/ is a better
> > home for it.
> >
> > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> > ---
> >
> >   MAINTAINERS                                   | 1 -
> >   certs/Makefile                                | 2 +-
> >   {scripts =3D> certs}/check-blacklist-hashes.awk | 0
> >   3 files changed, 1 insertion(+), 2 deletions(-)
> >   rename {scripts =3D> certs}/check-blacklist-hashes.awk (100%)
> >
> > diff --git a/MAINTAINERS b/MAINTAINERS
> > index 1fc9ead83d2a..7c2a7c304824 100644
> > --- a/MAINTAINERS
> > +++ b/MAINTAINERS
> > @@ -4627,7 +4627,6 @@ L:      keyrings@vger.kernel.org
> >   S:  Maintained
> >   F:  Documentation/admin-guide/module-signing.rst
> >   F:  certs/
> > -F:   scripts/check-blacklist-hashes.awk >   F:       scripts/sign-file=
.c
> >   F:  tools/certs/
> >
> > diff --git a/certs/Makefile b/certs/Makefile
> > index a8d628fd5f7b..df7aaeafd19c 100644
> > --- a/certs/Makefile
> > +++ b/certs/Makefile
> > @@ -13,7 +13,7 @@ CFLAGS_blacklist_hashes.o :=3D -I $(obj)
> >
> >   quiet_cmd_check_and_copy_blacklist_hash_list =3D GEN     $@
> >         cmd_check_and_copy_blacklist_hash_list =3D \
> > -     $(AWK) -f $(srctree)/scripts/check-blacklist-hashes.awk $(CONFIG_=
SYSTEM_BLACKLIST_HASH_LIST) >&2; \
> > +     $(AWK) -f $(srctree)/$(src)/check-blacklist-hashes.awk $(CONFIG_S=
YSTEM_BLACKLIST_HASH_LIST) >&2; \
> >       cat $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) > $@
> >
> >   $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORC=
E
> > diff --git a/scripts/check-blacklist-hashes.awk b/certs/check-blacklist=
-hashes.awk
> > similarity index 100%
> > rename from scripts/check-blacklist-hashes.awk
> > rename to certs/check-blacklist-hashes.awk
>
> It looks more appropriate and consistent to me to keep it in scripts/,
> close to other cert scripts. Is there some precedent to move such script?


I always did that.   For example,

  f6f57a46435d7253a52a1a07a58183678ad266a0
  78a20a012ecea857e438b1f9e8091acb290bd0f5
  28ba53c07638f31b153e3a32672a6124d0ff2a97
  4484aa800ac588a1fe2175cd53076c21067f44b4
  340a02535ee785c64c62a9c45706597a0139e972


Tools can stay in scripts/ if and only if:

  - it is used globally during kernel builds

  - it is still needed after the kernel builds.
     "make clean" removes most of the build artifacts
      but keeps ones under scripts/.


scripts/insert-sys-cert is apparently unneeded for building the kernel.
If the intended use is to manipulate vmlinux later,
that is the legitimate reason to stay in scripts/.
(but even better place might be tools/)


certs/signing_key.pem is needed even after kernel builds.
So, it should have been kept under scripts/ instead of certs/.


--
Best Regards
Masahiro Yamada