From patchwork Fri Nov 5 03:59:54 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahiro Yamada X-Patchwork-Id: 12604223 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0572BC433EF for ; Fri, 5 Nov 2021 04:03:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DF2B661056 for ; Fri, 5 Nov 2021 04:03:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229749AbhKEEG0 (ORCPT ); Fri, 5 Nov 2021 00:06:26 -0400 Received: from condef-04.nifty.com ([202.248.20.69]:61766 "EHLO condef-04.nifty.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229470AbhKEEGZ (ORCPT ); Fri, 5 Nov 2021 00:06:25 -0400 Received: from conuserg-08.nifty.com ([10.126.8.71])by condef-04.nifty.com with ESMTP id 1A540ge5002124 for ; Fri, 5 Nov 2021 13:00:57 +0900 Received: from grover.. (133-32-232-101.west.xps.vectant.ne.jp [133.32.232.101]) (authenticated) by conuserg-08.nifty.com with ESMTP id 1A5403LQ022540; Fri, 5 Nov 2021 13:00:04 +0900 DKIM-Filter: OpenDKIM Filter v2.10.3 conuserg-08.nifty.com 1A5403LQ022540 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.com; s=dec2015msa; t=1636084804; bh=UBeP22s4xfPYWsFjyoiM12my2Sqc+H6BgyJExMAZa7Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aZz5LIrfqBkBbjSDtExiwKrybXovZ8unNqfpMxgJjRutoLT+GtFTH5GdfrpBNq4BC Vsi/Hzwi8uBSoNYEUSPSg/Qbla0bPpAPR2mpkhgA09sFfekMN2B6EO9T2JGK0oyInW 2TA63C5OkJYB+mbwIkTX0+fd7kfChD9Co7LHdZ5fvuSx9aDIKmT5c71dE6vEQnH+UT 8YG/0lJLWtpv9ZZk+6D1sINOx9hB7xBOaVKK2oVLEv1XEB5BXZ6wCKBsOnLV9C1RI6 uQwBDFfcnQt+RlCrTLMDBwFckCIHfbyni+CE8ypEqrKSgdscIsYu/efoYxvHVcJf+r /h61pD40FPUiA== X-Nifty-SrcIP: [133.32.232.101] From: Masahiro Yamada To: Jarkko Sakkinen , David Howells , David Woodhouse , keyrings@vger.kernel.org Cc: Arnd Bergmann , Masahiro Yamada , linux-kernel@vger.kernel.org Subject: [PATCH 1/5] certs: remove meaningless $(error ...) in certs/Makefile Date: Fri, 5 Nov 2021 12:59:54 +0900 Message-Id: <20211105035959.93748-2-masahiroy@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211105035959.93748-1-masahiroy@kernel.org> References: <20211105035959.93748-1-masahiroy@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org CONFIG_MODULE_SIG_HASH is defined by init/Kconfig. This $(error ...) is never reachable. (If it is, you need to fix the bug.) Signed-off-by: Masahiro Yamada --- certs/Makefile | 3 --- 1 file changed, 3 deletions(-) diff --git a/certs/Makefile b/certs/Makefile index 279433783b10..db1fd2f4b950 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -50,9 +50,6 @@ ifdef SIGN_KEY # fail and that the kernel may be used afterwards. # ############################################################################### -ifndef CONFIG_MODULE_SIG_HASH -$(error Could not determine digest type to use from kernel config) -endif redirect_openssl = 2>&1 quiet_redirect_openssl = 2>&1 From patchwork Fri Nov 5 03:59:55 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahiro Yamada X-Patchwork-Id: 12604211 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5045C433EF for ; Fri, 5 Nov 2021 04:02:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 923B8611C0 for ; Fri, 5 Nov 2021 04:02:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229481AbhKEEFB (ORCPT ); Fri, 5 Nov 2021 00:05:01 -0400 Received: from condef-08.nifty.com ([202.248.20.73]:31046 "EHLO condef-08.nifty.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229470AbhKEEFB (ORCPT ); Fri, 5 Nov 2021 00:05:01 -0400 Received: from conuserg-08.nifty.com ([10.126.8.71])by condef-08.nifty.com with ESMTP id 1A540g2B014494 for ; Fri, 5 Nov 2021 13:01:00 +0900 Received: from grover.. (133-32-232-101.west.xps.vectant.ne.jp [133.32.232.101]) (authenticated) by conuserg-08.nifty.com with ESMTP id 1A5403LR022540; Fri, 5 Nov 2021 13:00:05 +0900 DKIM-Filter: OpenDKIM Filter v2.10.3 conuserg-08.nifty.com 1A5403LR022540 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.com; s=dec2015msa; t=1636084805; bh=EPDtRPV2+xH9RWj1xZYWenqqZGDd4nEA5G4pvBvsUB0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sT0YkNOglsncCLPqLtafFuBl+1IGVXOaf3w2FmjLCnR834e+5PXK/ofKEbaCLP1Ne lUvZFsVn9fjRIS0p5UFcuAgGAk6qAIuqH2RFaEIKRNP4dD04wnH6fMVonUZL2os6We vAKWKgHv3Fnq+CbcvbvvOSACLYDj1NHf0krZwv8Ioqb6F/qdSHVrB2gAumIIeIZur2 30+cld5q8KY7Y2cmZGoy0NKZaJviLt0NgDpFlAw7/lr1L764U2PrNURQ5VRPZyGs62 uDgfGM9XIkf88y5e/rQdOOfJx7jbnDhauulhAt+pNR4tk5YZ3/0TEbjbpuyisHMWcE mEYvexfW02+rg== X-Nifty-SrcIP: [133.32.232.101] From: Masahiro Yamada To: Jarkko Sakkinen , David Howells , David Woodhouse , keyrings@vger.kernel.org Cc: Arnd Bergmann , Masahiro Yamada , linux-kernel@vger.kernel.org Subject: [PATCH 2/5] certs: check-in the default x509 config file Date: Fri, 5 Nov 2021 12:59:55 +0900 Message-Id: <20211105035959.93748-3-masahiroy@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211105035959.93748-1-masahiroy@kernel.org> References: <20211105035959.93748-1-masahiroy@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org When x509.genkey is created, it prints a log: Generating X.509 key generation config ..., which is not the ordinary Kbuild log style. Check-in the default config as certs/default_x509.genkey to make it readable, and copy it to certs/x509.genkey if it is not present. The log is shown in the Kbuild style. COPY certs/x509.genkey Signed-off-by: Masahiro Yamada --- certs/Makefile | 24 ++++++------------------ certs/default_x509.genkey | 17 +++++++++++++++++ 2 files changed, 23 insertions(+), 18 deletions(-) create mode 100644 certs/default_x509.genkey diff --git a/certs/Makefile b/certs/Makefile index db1fd2f4b950..fc94a260e3f3 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -98,25 +98,13 @@ $(obj)/signing_key.pem: $(obj)/x509.genkey @$(kecho) "### Key pair generated." @$(kecho) "###" +quiet_cmd_copy_x509_config = COPY $@ + cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@ + +# You can provide your own config file. If not present, copy the default one. $(obj)/x509.genkey: - @$(kecho) Generating X.509 key generation config - @echo >$@ "[ req ]" - @echo >>$@ "default_bits = 4096" - @echo >>$@ "distinguished_name = req_distinguished_name" - @echo >>$@ "prompt = no" - @echo >>$@ "string_mask = utf8only" - @echo >>$@ "x509_extensions = myexts" - @echo >>$@ - @echo >>$@ "[ req_distinguished_name ]" - @echo >>$@ "#O = Unspecified company" - @echo >>$@ "CN = Build time autogenerated kernel key" - @echo >>$@ "#emailAddress = unspecified.user@unspecified.company" - @echo >>$@ - @echo >>$@ "[ myexts ]" - @echo >>$@ "basicConstraints=critical,CA:FALSE" - @echo >>$@ "keyUsage=digitalSignature" - @echo >>$@ "subjectKeyIdentifier=hash" - @echo >>$@ "authorityKeyIdentifier=keyid" + $(call cmd,copy_x509_config) + endif # CONFIG_MODULE_SIG_KEY $(eval $(call config_filename,MODULE_SIG_KEY)) diff --git a/certs/default_x509.genkey b/certs/default_x509.genkey new file mode 100644 index 000000000000..d4c6628cb8e5 --- /dev/null +++ b/certs/default_x509.genkey @@ -0,0 +1,17 @@ +[ req ] +default_bits = 4096 +distinguished_name = req_distinguished_name +prompt = no +string_mask = utf8only +x509_extensions = myexts + +[ req_distinguished_name ] +#O = Unspecified company +CN = Build time autogenerated kernel key +#emailAddress = unspecified.user@unspecified.company + +[ myexts ] +basicConstraints=critical,CA:FALSE +keyUsage=digitalSignature +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid From patchwork Fri Nov 5 03:59:56 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahiro Yamada X-Patchwork-Id: 12604217 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8AC52C433EF for ; Fri, 5 Nov 2021 04:03:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6803C611EF for ; Fri, 5 Nov 2021 04:03:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229588AbhKEEGD (ORCPT ); Fri, 5 Nov 2021 00:06:03 -0400 Received: from condef-07.nifty.com ([202.248.20.72]:64901 "EHLO condef-07.nifty.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229470AbhKEEGD (ORCPT ); Fri, 5 Nov 2021 00:06:03 -0400 Received: from conuserg-08.nifty.com ([10.126.8.71])by condef-07.nifty.com with ESMTP id 1A540gXj013396 for ; Fri, 5 Nov 2021 13:00:58 +0900 Received: from grover.. (133-32-232-101.west.xps.vectant.ne.jp [133.32.232.101]) (authenticated) by conuserg-08.nifty.com with ESMTP id 1A5403LS022540; Fri, 5 Nov 2021 13:00:05 +0900 DKIM-Filter: OpenDKIM Filter v2.10.3 conuserg-08.nifty.com 1A5403LS022540 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.com; s=dec2015msa; t=1636084806; bh=8vQXG6riwPCY1OZUaVklMhf4cyaWbn73E2iQY/uxxAY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MP/ddmeaCKhigbw8ynRkAJJDefLnZJCAj2+TR4Ne/hPxsSWsafpG2yWeMMB/c2ue5 HIgiwqOq0SuTqdgXgZY+DaQPpsk5xGP6oYITFEn3RjhUh3pzDhD1iGeejFffcvTrnT YHYSWMpp6mGxKRxeRlZtTzpxJPofo9N3jR1/omBFKDx93axhj7tTBCIoZAMd4NG5Ki STU82oH6mWx+T4iGkPvwsIy4Swwx7rMiQlSNasH8PNB9X9F0UgnHxxpoU8aQmKOQAx E+R6EIi+ZJW5e4x9muOtDJ6RwKYYiB72KvncCbhWSoGsRwjN0z5/aXWZDhrncuu1TE 8RXXVLUTeyiqA== X-Nifty-SrcIP: [133.32.232.101] From: Masahiro Yamada To: Jarkko Sakkinen , David Howells , David Woodhouse , keyrings@vger.kernel.org Cc: Arnd Bergmann , Masahiro Yamada , linux-kernel@vger.kernel.org Subject: [PATCH 3/5] certs: remove noisy messages while generating the signing key Date: Fri, 5 Nov 2021 12:59:56 +0900 Message-Id: <20211105035959.93748-4-masahiroy@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211105035959.93748-1-masahiroy@kernel.org> References: <20211105035959.93748-1-masahiroy@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org When you run Kbuild with the parallel option -j, the messages from this rule and others are interleaved, like follows: ### CC arch/x86/mm/pat/set_memory.o ### Now generating an X.509 key pair to be used for signing modules. ### ### If this takes a long time, you might wish to run rngd in the ### background to keep the supply of entropy topped up. It CC arch/x86/events/intel/bts.o HDRTEST usr/include/linux/qnx4_fs.h CC arch/x86/events/zhaoxin/core.o ### needs to be run as root, and uses a hardware random ### number generator if one is available. AR init/built-in.a ### On modern machines, it does not take a long time to generate the key. Remove the ugly log messages. Signed-off-by: Masahiro Yamada --- certs/Makefile | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/certs/Makefile b/certs/Makefile index fc94a260e3f3..a8c9abceef00 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -80,23 +80,12 @@ endif endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA $(obj)/signing_key.pem: $(obj)/x509.genkey - @$(kecho) "###" - @$(kecho) "### Now generating an X.509 key pair to be used for signing modules." - @$(kecho) "###" - @$(kecho) "### If this takes a long time, you might wish to run rngd in the" - @$(kecho) "### background to keep the supply of entropy topped up. It" - @$(kecho) "### needs to be run as root, and uses a hardware random" - @$(kecho) "### number generator if one is available." - @$(kecho) "###" $(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ -batch -x509 -config $(obj)/x509.genkey \ -outform PEM -out $(obj)/signing_key.pem \ -keyout $(obj)/signing_key.pem \ $(keytype_openssl) \ $($(quiet)redirect_openssl) - @$(kecho) "###" - @$(kecho) "### Key pair generated." - @$(kecho) "###" quiet_cmd_copy_x509_config = COPY $@ cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@ From patchwork Fri Nov 5 03:59:57 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahiro Yamada X-Patchwork-Id: 12604221 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D01AC433EF for ; Fri, 5 Nov 2021 04:03:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6865D61262 for ; Fri, 5 Nov 2021 04:03:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229847AbhKEEGM (ORCPT ); Fri, 5 Nov 2021 00:06:12 -0400 Received: from condef-09.nifty.com ([202.248.20.74]:47514 "EHLO condef-09.nifty.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229751AbhKEEGK (ORCPT ); Fri, 5 Nov 2021 00:06:10 -0400 Received: from conuserg-08.nifty.com ([10.126.8.71])by condef-09.nifty.com with ESMTP id 1A540gqg012303 for ; Fri, 5 Nov 2021 13:00:56 +0900 Received: from grover.. (133-32-232-101.west.xps.vectant.ne.jp [133.32.232.101]) (authenticated) by conuserg-08.nifty.com with ESMTP id 1A5403LT022540; Fri, 5 Nov 2021 13:00:06 +0900 DKIM-Filter: OpenDKIM Filter v2.10.3 conuserg-08.nifty.com 1A5403LT022540 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.com; s=dec2015msa; t=1636084807; bh=93aItTC3cXJl6t5PrCLwMkGAcu0s3I3/mz3gepIjUKw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nwEeIpP4AgaKYBvSqd4bKtoQj6Iy2NIKpfHCw2fPXJZ+9ZG6R8VB7EOAiU1prClcn kMdh+/dgkZaLlYq7/U3d4frSmg6ajLHE1JMGkPPc0wC/YFVm5NIXZkBtI3xsU6gqHh yVIcLZNY+UQBY8RAC5GewTJP0Z3f2X/J0lz8ZaF4fxj6PpHXv2asV+UNknDEfVdjA0 4yewAwiCzOowBru+7HPXF0yZkiKysN6ACxFh2xcbEzXwZK4J0GkIJ7dNAT5cC6fPYy c05X0VLbc915YN0vgwfLJPB/hMNFeUvzYiRLN2WkjR8Jac1NHDLRPMnMjy4qaLGnNz 7EQsd9YTA9Duw== X-Nifty-SrcIP: [133.32.232.101] From: Masahiro Yamada To: Jarkko Sakkinen , David Howells , David Woodhouse , keyrings@vger.kernel.org Cc: Arnd Bergmann , Masahiro Yamada , linux-kernel@vger.kernel.org Subject: [PATCH 4/5] certs: use 'cmd' to hide openssl output in silent builds more simply Date: Fri, 5 Nov 2021 12:59:57 +0900 Message-Id: <20211105035959.93748-5-masahiroy@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211105035959.93748-1-masahiroy@kernel.org> References: <20211105035959.93748-1-masahiroy@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Commit 5d06ee20b662 ("modsign: hide openssl output in silent builds") silenced the key generation log from openssl in silent builds. Since commit 174a1dcc9642 ("kbuild: sink stdout from cmd for silent build"), the 'cmd' macro can handle it in a cleaner way. Signed-off-by: Masahiro Yamada --- certs/Makefile | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/certs/Makefile b/certs/Makefile index a8c9abceef00..fdf206022113 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -51,9 +51,6 @@ ifdef SIGN_KEY # ############################################################################### -redirect_openssl = 2>&1 -quiet_redirect_openssl = 2>&1 -silent_redirect_openssl = 2>/dev/null openssl_available = $(shell openssl help 2>/dev/null && echo yes) # We do it this way rather than having a boolean option for enabling an @@ -79,13 +76,16 @@ $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.p endif endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA -$(obj)/signing_key.pem: $(obj)/x509.genkey - $(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ +quiet_cmd_gen_key = GENKEY $@ + cmd_gen_key = openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ -batch -x509 -config $(obj)/x509.genkey \ -outform PEM -out $(obj)/signing_key.pem \ -keyout $(obj)/signing_key.pem \ $(keytype_openssl) \ - $($(quiet)redirect_openssl) + 2>&1 + +$(obj)/signing_key.pem: $(obj)/x509.genkey + $(call cmd,gen_key) quiet_cmd_copy_x509_config = COPY $@ cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@ From patchwork Fri Nov 5 03:59:58 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahiro Yamada X-Patchwork-Id: 12604219 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 178F3C433F5 for ; Fri, 5 Nov 2021 04:03:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F08FD611C1 for ; Fri, 5 Nov 2021 04:03:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229922AbhKEEGL (ORCPT ); Fri, 5 Nov 2021 00:06:11 -0400 Received: from condef-03.nifty.com ([202.248.20.68]:48451 "EHLO condef-03.nifty.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229749AbhKEEGK (ORCPT ); Fri, 5 Nov 2021 00:06:10 -0400 Received: from conuserg-08.nifty.com ([10.126.8.71])by condef-03.nifty.com with ESMTP id 1A540gkN008117 for ; Fri, 5 Nov 2021 13:01:00 +0900 Received: from grover.. (133-32-232-101.west.xps.vectant.ne.jp [133.32.232.101]) (authenticated) by conuserg-08.nifty.com with ESMTP id 1A5403LU022540; Fri, 5 Nov 2021 13:00:07 +0900 DKIM-Filter: OpenDKIM Filter v2.10.3 conuserg-08.nifty.com 1A5403LU022540 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.com; s=dec2015msa; t=1636084807; bh=jddleuDKBxe/P3YZOxewL3DfC/cVOoAyPm2jkKAyeJ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=znEQ3uNNcjfWQy7WHIJDrMJrbRaezPQtjncDyWGVBSV1gOL7OWj3YxD5y+DtBhg4a HHOoRWdaLUdUCFHAyg7g+2RbltS5LUJFFzJE9gpTRoRsT9yKnVw0cRs9j+u7/Qr4Ph ezZ5Kn7Tnw92ceksGCUAQYAGy+z08aWAPNCN54VdAt7OZkK/2/4J3pTVLYhmNTEQAE Zo5WgNbByaEHlCugjDlXzKDunfN85wiXF2tlTDP5EV3+5cKJWbR8y7Z6QH1xrm30LH 6m3SRMWr2Jbb6OMnONhcLH/nLITLjZ1LWzx1M071vpv2dpAtO/nd49IOBXxFTyDqtM MdfEaQ2d0iIdA== X-Nifty-SrcIP: [133.32.232.101] From: Masahiro Yamada To: Jarkko Sakkinen , David Howells , David Woodhouse , keyrings@vger.kernel.org Cc: Arnd Bergmann , Masahiro Yamada , linux-kernel@vger.kernel.org Subject: [PATCH 5/5] certs: use if_changed to re-generate the key when the key type is changed Date: Fri, 5 Nov 2021 12:59:58 +0900 Message-Id: <20211105035959.93748-6-masahiroy@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211105035959.93748-1-masahiroy@kernel.org> References: <20211105035959.93748-1-masahiroy@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org If the key type of the existing signing key does not match to CONFIG_MODULE_SIG_KEY_TYPE_*, the Makefile removes it so that it is re-generated. Use if_changed so that the key is re-generated when the key type is changed (that is, the openssl command line is changed). Signed-off-by: Masahiro Yamada --- certs/Makefile | 30 ++++++------------------------ 1 file changed, 6 insertions(+), 24 deletions(-) diff --git a/certs/Makefile b/certs/Makefile index fdf206022113..a702b70f3cb9 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -51,41 +51,23 @@ ifdef SIGN_KEY # ############################################################################### -openssl_available = $(shell openssl help 2>/dev/null && echo yes) - # We do it this way rather than having a boolean option for enabling an # external private key, because 'make randconfig' might enable such a # boolean option and we unfortunately can't make it depend on !RANDCONFIG. ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") -ifeq ($(openssl_available),yes) -X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null) -endif - -# Support user changing key type -ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA -keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -ifeq ($(openssl_available),yes) -$(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem")) -endif -endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA - -ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA -ifeq ($(openssl_available),yes) -$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem")) -endif -endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA +keytype-$(CONFIG_MODULE_SIG_KEY_TYPE_ECDSA) := -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 quiet_cmd_gen_key = GENKEY $@ cmd_gen_key = openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ -batch -x509 -config $(obj)/x509.genkey \ -outform PEM -out $(obj)/signing_key.pem \ - -keyout $(obj)/signing_key.pem \ - $(keytype_openssl) \ - 2>&1 + -keyout $(obj)/signing_key.pem $(keytype-y) 2>&1 + +$(obj)/signing_key.pem: $(obj)/x509.genkey FORCE + $(call if_changed,gen_key) -$(obj)/signing_key.pem: $(obj)/x509.genkey - $(call cmd,gen_key) +targets += signing_key.pem quiet_cmd_copy_x509_config = COPY $@ cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@