diff options
| author | Masahiro Yamada <masahiroy@kernel.org> | 2023-08-23 20:50:47 +0900 |
|---|---|---|
| committer | Masahiro Yamada <masahiroy@kernel.org> | 2023-09-01 15:58:17 +0900 |
| commit | 02e8487bbf1b68b29f7759154728071af08091cb (patch) | |
| tree | decf8cd16b34c35ea536eca3bd5dcf04c31f2731 | |
| parent | 5e02797b8eb093ba73fcbdc6048d02a3f9fb7379 (diff) | |
| download | linux-stable-02e8487bbf1b68b29f7759154728071af08091cb.tar.gz linux-stable-02e8487bbf1b68b29f7759154728071af08091cb.tar.bz2 linux-stable-02e8487bbf1b68b29f7759154728071af08091cb.zip | |
kbuild: support 'make modules_sign' with CONFIG_MODULE_SIG_ALL=n
Commit d890f510c8e4 ("MODSIGN: Add modules_sign make target") introduced
'make modules_sign' to manually sign modules.
Some time later, commit d9d8d7ed498e ("MODSIGN: Add option to not sign
modules during modules_install") introduced CONFIG_MODULE_SIG_ALL.
If it was disabled, mod_sign_cmd was set to no-op ('true' command).
It affected not only 'make modules_install' but also 'make modules_sign'.
With CONFIG_MODULE_SIG_ALL=n, neither modules_install nor modules_sign
is able to sign modules.
Kbuild has kept that behavior, and nobody has complained about it, but
I think it is weird.
CONFIG_MODULE_SIG_ALL=n should turn off signing only for modules_install.
If users want to sign modules manually, modules_sign should be offered.
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nicolas Schier <nicolas@fjasle.eu>
| -rw-r--r-- | scripts/Makefile.modinst | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst index 5e2f98f0e991..a5fa3ea46652 100644 --- a/scripts/Makefile.modinst +++ b/scripts/Makefile.modinst @@ -95,7 +95,6 @@ endif # Signing # Don't stop modules_install even if we can't sign external modules. # -ifeq ($(CONFIG_MODULE_SIG_ALL),y) ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),) sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY) else @@ -104,13 +103,15 @@ endif quiet_cmd_sign = SIGN $@ cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \ $(if $(KBUILD_EXTMOD),|| true) -else + +ifeq ($(modules_sign_only),) + +# During modules_install, modules are signed only when CONFIG_MODULE_SIG_ALL=y. +ifndef CONFIG_MODULE_SIG_ALL quiet_cmd_sign := cmd_sign := : endif -ifeq ($(modules_sign_only),) - # Create necessary directories $(shell mkdir -p $(sort $(dir $(install-y)))) |