On Fri, Feb 20, 2015 at 02:52:14PM +0100, Michal Marek wrote: > On 2015-02-19 13:26, David Howells wrote: > > Michal Marek <mma...@suse.cz> wrote: > > > >> +X509_CERTIFICATES-y := $(wildcard *.x509) > >> +ifneq ($(objtree),$(srctree)) > >> +X509_CERTIFICATES-y += $(wildcard $(srctree)/*.x509) > >> +endif > >> +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 > >> +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) > > > > What will happen if there's a "signing_key.x509" in the source tree when O= > > is > > used? > > It will fail. So the patch needs more work, thanks for the review.
OK, this works for me and I finally understand why :). The problem is that whatever file make sees (as a target or dependency) first, it will prefer it for the purpose of VPATH search, so the right signing_key.x509 must come first. Unfortunately, using 'vpath %.x509' does not do the trick, because this merely says not to use any special VPATH for files matching this pattern, but it does not avoid the global VPATH. >From 1774298ef0fa770cd7e8810ed57ceb4e8a7c5def Mon Sep 17 00:00:00 2001 From: Michal Marek <mma...@suse.cz> Date: Wed, 8 Oct 2014 13:15:28 +0200 Subject: [PATCH] X.509: Fix certificate gathering again Commit d7ec435f (X.509: Fix certificate gathering) fixed the issue of changing .x509.list, but in the CONFIG_MODULE_SIG=y case, it assumed that $(objtree) was an absolute path. Commit 7e1c0477 (kbuild: Use relative path for $(objtree)) broke this assumption and we get uncecessary rebuilds again, due to ./signing_key.x509 changing to signing_key.x509. Instead of prepending the absolute path and stripping it again, just check if $(srctree) and $(objtree) are different directories and add $(srctree)/*.x509 only in such case. However, such fix causes a different issue, namely that a potential $(srctree)/signing_key.x509 appears before the to-be-generated signing_key.x509 in the sorted list, and make remembers this file for the purpose of VPATH search. It worked previously, because ./signing_key.x509 sorts before any absolute path. Solve this by sorting the $(objtree) and $(srctree) files separately, to ensure that signing_key.x509 appears before anything from $(srctree). Signed-off-by: Michal Marek <mma...@suse.cz> --- kernel/Makefile | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/kernel/Makefile b/kernel/Makefile index 1408b33..792e043 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -117,17 +117,18 @@ $(obj)/config_data.h: $(obj)/config_data.gz FORCE # boot. # # We look in the source root and the build root for all files whose name ends -# in ".x509". Unfortunately, this will generate duplicate filenames, so we -# have make canonicalise the pathnames and then sort them to discard the -# duplicates. +# in ".x509". We put the $(objtree) certificates before those from $(srctree), +# so that a potential signing_key.x509 file from $(srctree) does not take +# precedence. # ############################################################################### ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) -X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509) -X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509 -X509_CERTIFICATES-raw := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \ - $(or $(realpath $(CERT)),$(CERT)))) -X509_CERTIFICATES := $(subst $(realpath $(objtree))/,,$(X509_CERTIFICATES-raw)) +X509_CERTIFICATES-y := $(wildcard *.x509) +X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509 +X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y)) +ifneq ($(objtree),$(srctree)) +X509_CERTIFICATES += $(sort $(wildcard $(srctree)/*.x509)) +endif ifeq ($(X509_CERTIFICATES),) $(warning *** No X.509 certificates found ***) -- 1.9.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
