Changes in Makefile

300e6d41 - sign-file,extract-cert: move common SSL helper functions to a header

Fri, 12 Jul 2024 07:11:14 +0000

sign-file,extract-cert: move common SSL helper functions to a headerCouple error handling helpers are repeated in both tools, somove them to a common header.Signed-off-by: Jan Stancek Reviewed-by: Jarkko Sakkinen Tested-by: R Nageswara Sastry Reviewed-by: Neal Gompa Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/certs/Makefile

b1992c37 - kbuild: use $(src) instead of $(srctree)/$(src) for source directory

Sat, 27 Apr 2024 14:55:02 +0000

kbuild: use $(src) instead of $(srctree)/$(src) for source directoryKbuild conventionally uses $(obj)/ for generated files, and $(src)/ forchecked-in source files. It is merely a convention without any functionaldifference. In fact, $(obj) and $(src) are exactly the same, as definedin scripts/Makefile.build: src := $(obj)When the kernel is built in a separate output directory, $(src) doesnot accurately reflect the source directory location. While Kbuildresolves this discrepancy by specifying VPATH=$(srctree) to search forsource files, it does not cover all cases. For example, when adding aheader search path for local headers, -I$(srctree)/$(src) is typicallypassed to the compiler.This introduces inconsistency between upstream and downstream Makefilesbecause $(src) is used instead of $(srctree)/$(src) for the latter.To address this inconsistency, this commit changes the semantics of$(src) so that it always points to the directory in the source tree.Going forward, the variables used in Makefiles will have the followingmeanings: $(obj) - directory in the object tree $(src) - directory in the source tree (changed by this commit) $(objtree) - the top of the kernel object tree $(srctree) - the top of the kernel source treeConsequently, $(srctree)/$(src) in upstream Makefiles need to be replacedwith $(src).Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier List of files: /linux-6.15/certs/Makefile

b1c3d2be - certs: Fix build error when PKCS#11 URI contains semicolon

Tue, 31 Jan 2023 08:43:22 +0000

certs: Fix build error when PKCS#11 URI contains semicolonWhen CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*) and contains asemicolon, signing_key.x509 fails to build: certs/extract-cert pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 Usage: extract-cert Add quotes to the extract-cert argument to avoid splitting by the shell.This approach was suggested by Masahiro Yamada .Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf")Signed-off-by: Jan Luebbe Signed-off-by: Masahiro Yamada List of files: /linux-6.15/certs/Makefile

31f6d95c - certs: unify blacklist_hashes.c and blacklist_nohashes.c

Sat, 11 Jun 2022 17:22:33 +0000

certs: unify blacklist_hashes.c and blacklist_nohashes.cThese two files are very similar. Unify them.Signed-off-by: Masahiro Yamada Reviewed-by: Mickaël Salaün Reviewed-by: Jarkko Sakkinen List of files: /linux-6.15/certs/Makefile

9008a676 - certs: move scripts/check-blacklist-hashes.awk to certs/

Sat, 11 Jun 2022 17:22:32 +0000

certs: move scripts/check-blacklist-hashes.awk to certs/This script is only used in certs/Makefile, so certs/ is a betterhome for it.Signed-off-by: Masahiro Yamada Reviewed-by: Mickaël Salaün Reviewed-by: Jarkko Sakkinen List of files: /linux-6.15/certs/Makefile

60050ffe - certs: Move load_certificate_list() to be with the asymmetric keys code

Wed, 18 May 2022 22:48:09 +0000

certs: Move load_certificate_list() to be with the asymmetric keys codeMove load_certificate_list(), which loads a series of binary X.509certificates from a blob and inserts them as keys into a keyring, to bewith the asymmetric keys code that it drives.This makes it easier to add FIPS selftest code in which we need to load upa private keyring for the tests to use.Signed-off-by: David Howells Reviewed-by: Simo Sorce Reviewed-by: Herbert Xu cc: keyrings@vger.kernel.orgcc: linux-crypto@vger.kernel.orgLink: https://lore.kernel.org/r/165515742145.1554877.13488098107542537203.stgit@warthog.procyon.org.uk/ List of files: /linux-6.15/certs/Makefile

27b5b22d - certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build

Sat, 11 Jun 2022 17:22:31 +0000

certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST buildCommit addf466389d9 ("certs: Check that builtin blacklist hashes arevalid") was applied 8 months after the submission.In the meantime, the base code had been removed by commit b8c96a6b466c("certs: simplify $(srctree)/ handling and remove config_filenamemacro").Fix the Makefile.Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It isincluded from certs/blacklist_hashes.c and also works as a timestamp.Send error messages from check-blacklist-hashes.awk to stderr insteadof stdout.Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")Signed-off-by: Masahiro Yamada Reviewed-by: Jarkko Sakkinen Reviewed-by: Mickaël Salaün Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/certs/Makefile

d56fd986 - certs: Convert spaces in certs/Makefile to a tab

Fri, 10 Jun 2022 18:35:55 +0000

certs: Convert spaces in certs/Makefile to a tabThere's a rule in certs/Makefile for which the command begins with eightspaces. This results in: ../certs/Makefile:21: FORCE prerequisite is missing ../certs/Makefile:21: *** missing separator. Stop.Fix this by turning the spaces into a tab.Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid")Signed-off-by: David Howells Reviewed-by: Jarkko Sakkinen Reviewed-by: Mickaël Salaün cc: keyrings@vger.kernel.orgLink: https://lore.kernel.org/r/486b1b80-9932-aab6-138d-434c541c934a@digikod.net/ # v1Signed-off-by: Linus Torvalds List of files: /linux-6.15/certs/Makefile

addf4663 - certs: Check that builtin blacklist hashes are valid

Mon, 12 Jul 2021 17:03:10 +0000

certs: Check that builtin blacklist hashes are validAdd and use a check-blacklist-hashes.awk script to make sure that thebuiltin blacklist hashes set with CONFIG_SYSTEM_BLACKLIST_HASH_LIST willeffectively be taken into account as blacklisted hashes. This is usefulto debug invalid hash formats, and it make sure that previous hasheswhich could have been loaded in the kernel, but silently ignored, arenow noticed and deal with by the user at kernel build time.This also prevent stricter blacklist key description checking (providedby following commits) to failed for builtin hashes.Update CONFIG_SYSTEM_BLACKLIST_HASH_LIST help to explain the content ofa hash string and how to generate certificate ones.Cc: David Howells Cc: David Woodhouse Cc: Eric Snowberg Cc: Jarkko Sakkinen Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20210712170313.884724-3-mic@digikod.netReviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/certs/Makefile

d5ea4fec - kbuild: Allow kernel installation packaging to override pkg-config

Fri, 01 Apr 2022 23:18:02 +0000

kbuild: Allow kernel installation packaging to override pkg-configAdd HOSTPKG_CONFIG to allow tooling that builds the kernel to overridewhat pkg-config and parameters are used.Signed-off-by: Chun-Tse Shao Reviewed-by: Nick Desaulniers Signed-off-by: Masahiro Yamada List of files: /linux-6.15/certs/Makefile

f44b645f - certs: simplify empty certs creation in certs/Makefile

Fri, 18 Feb 2022 04:46:34 +0000

certs: simplify empty certs creation in certs/MakefileTo create an empty cert file, we need to pass "" to the extract-certtool, which is common for all the three call-sites of cmd_extract_certs.Factor out the logic into extract-cert-in.One exceptional case is PKCS#11 case, where we override extract-cert-inwith the URI.Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier List of files: /linux-6.15/certs/Makefile

6ce019f7 - certs: include certs/signing_key.x509 unconditionally

Fri, 18 Feb 2022 04:46:33 +0000

certs: include certs/signing_key.x509 unconditionallyI do not see much sense in the #if conditional in system_certificates.S;even if the condition is true, there exists no signing key whenCONFIG_MODULE_SIG_KEY="".So, certs/Makefile generates empty certs/signing_key.x509 in such acase. We can always do this, irrespective of CONFIG_MODULE_SIG or(CONFIG_IMA_APPRAISE_MODSIG && CONFIG_MODULES).We only need to check CONFIG_MODULE_SIG_KEY, then both *.S and Makefilewill become much simpler.Signed-off-by: Masahiro Yamada List of files: /linux-6.15/certs/Makefile

e6340b65 - certs: Fix build error when CONFIG_MODULE_SIG_KEY is empty

Thu, 20 Jan 2022 19:22:05 +0000

certs: Fix build error when CONFIG_MODULE_SIG_KEY is emptySince b8c96a6b466c ("certs: simplify $(srctree)/ handling and removeconfig_filename macro"), when CONFIG_MODULE_SIG_KEY is empty,signing_key.x509 fails to build: CERT certs/signing_key.x509 Usage: extract-cert make[1]: *** [certs/Makefile:78: certs/signing_key.x509] Error 2 make: *** [Makefile:1831: certs] Error 2Pass "" to the first argument of extract-cert to fix the build error.Link: https://lore.kernel.org/linux-kbuild/20220120094606.2skuyb26yjlnu66q@lion.mk-sys.cz/T/#uFixes: b8c96a6b466c ("certs: simplify $(srctree)/ handling and remove config_filename macro")Reported-by: Michal Kubecek Signed-off-by: Masahiro Yamada Tested-by: Michal Kubecek List of files: /linux-6.15/certs/Makefile

ad29a2fb - certs: Fix build error when CONFIG_MODULE_SIG_KEY is PKCS#11 URI

Thu, 20 Jan 2022 19:22:04 +0000

certs: Fix build error when CONFIG_MODULE_SIG_KEY is PKCS#11 URIWhen CONFIG_MODULE_SIG_KEY is PKCS#11 URL (pkcs11:*), signing_key.x509fails to build: certs/Makefile:77: *** target pattern contains no '%'. Stop.Due to the typo, $(X509_DEP) contains a colon.Fix it.Fixes: b8c96a6b466c ("certs: simplify $(srctree)/ handling and remove config_filename macro")Signed-off-by: Masahiro Yamada List of files: /linux-6.15/certs/Makefile

340a0253 - certs: move scripts/extract-cert to certs/

Tue, 14 Dec 2021 02:53:54 +0000

certs: move scripts/extract-cert to certs/extract-cert is only used in certs/Makefile.Move it there and build extract-cert on demand.Signed-off-by: Masahiro Yamada List of files: /linux-6.15/certs/Makefile

129ab0d2 - kbuild: do not quote string values in include/config/auto.conf

Tue, 14 Dec 2021 02:53:53 +0000

kbuild: do not quote string values in include/config/auto.confThe previous commit fixed up all shell scripts to not includeinclude/config/auto.conf.Now that include/config/auto.conf is only included by Makefiles,we can change it into a more Make-friendly form.Previously, Kconfig output string values enclosed with double-quotes(both in the .config and include/config/auto.conf): CONFIG_X="foo bar"Unlike shell, Make handles double-quotes (and single-quotes as well)verbatim. We must rip them off when used.There are some patterns: [1] $(patsubst "%",%,$(CONFIG_X)) [2] $(CONFIG_X:"%"=%) [3] $(subst ",,$(CONFIG_X)) [4] $(shell echo $(CONFIG_X))These are not only ugly, but also fragile.[1] and [2] do not work if the value contains spaces, like CONFIG_X=" foo bar "[3] does not work correctly if the value contains double-quotes like CONFIG_X="foo\"bar"[4] seems to work better, but has a cost of forking a process.Anyway, quoted strings were always PITA for our Makefiles.This commit changes Kconfig to stop quoting in include/config/auto.conf.These are the string type symbols referenced in Makefiles or scripts: ACPI_CUSTOM_DSDT_FILE ARC_BUILTIN_DTB_NAME ARC_TUNE_MCPU BUILTIN_DTB_SOURCE CC_IMPLICIT_FALLTHROUGH CC_VERSION_TEXT CFG80211_EXTRA_REGDB_KEYDIR EXTRA_FIRMWARE EXTRA_FIRMWARE_DIR EXTRA_TARGETS H8300_BUILTIN_DTB INITRAMFS_SOURCE LOCALVERSION MODULE_SIG_HASH MODULE_SIG_KEY NDS32_BUILTIN_DTB NIOS2_DTB_SOURCE OPENRISC_BUILTIN_DTB SOC_CANAAN_K210_DTB_SOURCE SYSTEM_BLACKLIST_HASH_LIST SYSTEM_REVOCATION_KEYS SYSTEM_TRUSTED_KEYS TARGET_CPU UNUSED_KSYMS_WHITELIST XILINX_MICROBLAZE0_FAMILY XILINX_MICROBLAZE0_HW_VER XTENSA_VARIANT_NAMEI checked them one by one, and fixed up the code where necessary.Signed-off-by: Masahiro Yamada List of files: /linux-6.15/certs/Makefile

b8c96a6b - certs: simplify $(srctree)/ handling and remove config_filename macro

Tue, 14 Dec 2021 02:53:51 +0000

certs: simplify $(srctree)/ handling and remove config_filename macroThe complex macro, config_filename, was introduced to do: [1] drop double-quotes from the string value [2] add $(srctree)/ prefix in case the file is not found in $(objtree) [3] escape spaces and more[1] will be more generally handled by Kconfig later.As for [2], Kbuild uses VPATH to search for files in $(objtree),$(srctree) in this order. GNU Make can natively handle it.As for [3], converting $(space) to $(space_escape) back and forth looksquestionable to me. It is well-known that GNU Make cannot handle filepaths with spaces in the first place.Instead of using the complex macro, use $< so it will be expanded tothe file path of the key.Remove config_filename, finally.Signed-off-by: Masahiro Yamada List of files: /linux-6.15/certs/Makefile

5410f3e8 - certs: remove misleading comments about GCC PR

Tue, 14 Dec 2021 02:53:49 +0000

certs: remove misleading comments about GCC PRThis dependency is necessary irrespective of the mentioned GCC PRbecause the embedded certificates are build artifacts and must begenerated by extract_certs before *.S files are compiled.The comment sounds like we are hoping to remove these dependenciessomeday. No, we cannot remove them.Signed-off-by: Masahiro Yamada List of files: /linux-6.15/certs/Makefile

5cca3606 - certs: refactor file cleaning

Tue, 14 Dec 2021 02:53:48 +0000

certs: refactor file cleaning'make clean' removes files listed in 'targets'. It is redundant tospecify both 'targets' and 'clean-files'.Move 'targets' assignments out of the ifeq-conditionals soscripts/Makefile.clean can see them.One effective change is that certs/certs/signing_key.x509 is nowdeleted by 'make clean' instead of 'make mrproper. This certificateis embedded in the kernel. It is not used in any way by externalmodule builds.Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier List of files: /linux-6.15/certs/Makefile

3958f215 - certs: remove unneeded -I$(srctree) option for system_certificates.o

Tue, 14 Dec 2021 02:53:47 +0000

certs: remove unneeded -I$(srctree) option for system_certificates.oThe .incbin directive in certs/system_certificates.S includescerts/signing_key.x509 and certs/x509_certificate_list, both of whichare generated by extract_certs, i.e. exist in $(objtree).This option -I$(srctree) is unneeded.Signed-off-by: Masahiro Yamada List of files: /linux-6.15/certs/Makefile