summaryrefslogtreecommitdiff
path: root/scripts
diff options
context:
space:
mode:
authorMasahiro Yamada <masahiroy@kernel.org>2023-08-23 14:50:47 +0300
committerMasahiro Yamada <masahiroy@kernel.org>2023-09-01 09:58:17 +0300
commit02e8487bbf1b68b29f7759154728071af08091cb (patch)
treedecf8cd16b34c35ea536eca3bd5dcf04c31f2731 /scripts
parent5e02797b8eb093ba73fcbdc6048d02a3f9fb7379 (diff)
downloadlinux-02e8487bbf1b68b29f7759154728071af08091cb.tar.xz
kbuild: support 'make modules_sign' with CONFIG_MODULE_SIG_ALL=n
Commit d890f510c8e4 ("MODSIGN: Add modules_sign make target") introduced 'make modules_sign' to manually sign modules. Some time later, commit d9d8d7ed498e ("MODSIGN: Add option to not sign modules during modules_install") introduced CONFIG_MODULE_SIG_ALL. If it was disabled, mod_sign_cmd was set to no-op ('true' command). It affected not only 'make modules_install' but also 'make modules_sign'. With CONFIG_MODULE_SIG_ALL=n, neither modules_install nor modules_sign is able to sign modules. Kbuild has kept that behavior, and nobody has complained about it, but I think it is weird. CONFIG_MODULE_SIG_ALL=n should turn off signing only for modules_install. If users want to sign modules manually, modules_sign should be offered. Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Reviewed-by: Nicolas Schier <nicolas@fjasle.eu>
Diffstat (limited to 'scripts')
-rw-r--r--scripts/Makefile.modinst9
1 files changed, 5 insertions, 4 deletions
diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst
index 5e2f98f0e991..a5fa3ea46652 100644
--- a/scripts/Makefile.modinst
+++ b/scripts/Makefile.modinst
@@ -95,7 +95,6 @@ endif
# Signing
# Don't stop modules_install even if we can't sign external modules.
#
-ifeq ($(CONFIG_MODULE_SIG_ALL),y)
ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),)
sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY)
else
@@ -104,13 +103,15 @@ endif
quiet_cmd_sign = SIGN $@
cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \
$(if $(KBUILD_EXTMOD),|| true)
-else
+
+ifeq ($(modules_sign_only),)
+
+# During modules_install, modules are signed only when CONFIG_MODULE_SIG_ALL=y.
+ifndef CONFIG_MODULE_SIG_ALL
quiet_cmd_sign :=
cmd_sign := :
endif
-ifeq ($(modules_sign_only),)
-
# Create necessary directories
$(shell mkdir -p $(sort $(dir $(install-y))))