Valdis Klētnieks <valdis.kletni...@vt.edu> wrote: > > Possibly I can add something like: > > > > clean-files := signing_key.pem x509.genkey > > > > inside the > > > > ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") > > ... > > endif > > Would that remove them on a 'make clean', or only a 'make mrproper'? > The latter sounds like the correct solution to me, as the signing key should > have (roughly) the same lifetime rules as the .config file.
It would appear that it works on neither. Neither of them seem to have any CONFIG_xxx symbols set. How about the attached patch? David --- commit 95897dc8dc13ad13c637a477a1ead9b63ff1fafa Author: David Howells <dhowe...@redhat.com> Date: Fri Mar 12 10:48:25 2021 +0000 certs: Clean up signing_key.pem and x509.genkey on make mrproper Autogenerated signing_key.pem and x509.genkey files aren't removed from the build certs/ directory when "make mrproper" is run. This is somewhat deliberate since the "file" is specified by the CONFIG_MODULE_SIG_KEY string option and may not be in the build tree - and may not even be a filename, but rather a PKCS#7 URI (also the config variables doesn't seem to be set when cleaning). Fix this by unconditionally listing signing_key.pem and x509.genkey for removal from the build certs/ directory - which will just do nothing if they're not there, and shouldn't remove signing keys that are configured to be elsewhere. Note that this will permanently erase the autogenerated private key, so anyone that is relying on it still being around after doing make mrproper will no longer find it. Fixes: cfc411e7fff3 ("Move certificate handling to its own directory") Reported-by: Valdis Klētnieks <valdis.kletni...@vt.edu> Signed-off-by: David Howells <dhowe...@redhat.com> Link: https://lore.kernel.org/r/134696.1615510534@turing-police/ [1] diff --git a/certs/Makefile b/certs/Makefile index f4c25b67aad9..2ae1dd518bc7 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -104,3 +104,5 @@ targets += signing_key.x509 $(obj)/signing_key.x509: scripts/extract-cert $(X509_DEP) FORCE $(call if_changed,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY)) endif # CONFIG_MODULE_SIG + +clean-files += signing_key.pem x509.genkey