From patchwork Fri Jul 29 08:49:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Juerg Haefliger X-Patchwork-Id: 1661924 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=dxQCROAG; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4LvLmY1NWWz9sGH for ; Fri, 29 Jul 2022 18:49:32 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1oHLgT-0007PQ-NY; Fri, 29 Jul 2022 08:49:25 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1oHLgS-0007Ov-DN for kernel-team@lists.ubuntu.com; Fri, 29 Jul 2022 08:49:24 +0000 Received: from mail-ej1-f70.google.com (mail-ej1-f70.google.com [209.85.218.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 19A123F119 for ; Fri, 29 Jul 2022 08:49:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1659084564; bh=8QQZGSAbt4dP2ARmsH7NKsr2OMNBzNy2oKHJOGBdfBs=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=dxQCROAGM46Lh5xZe4wD2LRj76Cs3bihNLhM4tMqdG72CFOWuuxNBQmqOmpOw8BEv 93gF1NHXWTd2oIPUelRYDyXHBmdzKaj0ZDb8rpF1S518aOa5dvMM6oJzAnOhpkyMU7 JaL2Gp7auGhjR21o+MfOHW2J+1lZz2H60EUCcKNydcFnjVxt9EpxoiPtCBgbIUpEbw SEkVedvIyLcmxbj7ItFuH/Y3S9tER2hiKc1QAXkDgJOCURYu7400vhuxOWHnvU8GN3 SRjWN6cyie6U8Asa7ZqOaiGKdCk/oxZ6X/f2Br6WbBLBNsiOvnr31dJ4DATvyLj3bW 824otXGUszXxA== Received: by mail-ej1-f70.google.com with SMTP id hv22-20020a17090760d600b0072f2cce7d10so1543302ejc.19 for ; Fri, 29 Jul 2022 01:49:24 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc; bh=8QQZGSAbt4dP2ARmsH7NKsr2OMNBzNy2oKHJOGBdfBs=; b=ENy3lzHRagea2AapiDSWCiQSVt3HkSI2zMWDDflGHHGQzXFyvgNTGTBU+W2TCWJIGH rxzAO3PMH3WOyIsmmLOdjEqvdSK+X0SEJ2XUJnUPkDET9NkoPgOw6KvZ5FVbdtK9+eRY 2+tmpEkzzlxwSPa4yqxfluDAs5KvhlNrtE5d3p9xQsMmPUDrCc5tnfjDvjLvWTzlWI66 TxUCDxYjRodctTavrokUQgjoq8tekHG/E19jrYoXZBROddjtPlT+Sg/qyXfkTyz/hpkP Abu3tieBRq2pNnHMBhb3co4vH/ku2CUC6PhbXJXxws8ULfe5O/lltH69kfAF/jf/jdt4 jhrw== X-Gm-Message-State: AJIora+TgQm8Luy2ADpOLwuc4V6kAq7sdxWvRw4p8PFBES52KLPZI730 zIIVjOcjnnbee8gPMfrGCg4Ra+r8bCEd33YlwhCsKsVAOCWfmFhr/REXNcmhmHqcpAiwXHNB9CR jm/mYEDS4/46p9jVZKLpfIbiIfpAn4mY2KTC4j4LulQ== X-Received: by 2002:aa7:da83:0:b0:43c:abc2:fffb with SMTP id q3-20020aa7da83000000b0043cabc2fffbmr2506082eds.396.1659084563849; Fri, 29 Jul 2022 01:49:23 -0700 (PDT) X-Google-Smtp-Source: AGRyM1sztjDinlIEoomjTTH/HC1023pkC9p1dDn9PgvkN48MEu5DQgt6PRPwfpG/ydQU7oiokjitQg== X-Received: by 2002:aa7:da83:0:b0:43c:abc2:fffb with SMTP id q3-20020aa7da83000000b0043cabc2fffbmr2506067eds.396.1659084563573; Fri, 29 Jul 2022 01:49:23 -0700 (PDT) Received: from gollum.fritz.box ([194.191.244.86]) by smtp.gmail.com with ESMTPSA id w6-20020a1709064a0600b0072aa38d768esm1413949eju.64.2022.07.29.01.49.22 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 Jul 2022 01:49:22 -0700 (PDT) From: Juerg Haefliger To: kernel-team@lists.ubuntu.com Subject: [unstable/kinetic][PATCH 1/3] UBUNTU: [Packaging] module-signature-check: Check debian./signature-inclusion Date: Fri, 29 Jul 2022 10:49:19 +0200 Message-Id: <20220729084921.767082-2-juerg.haefliger@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220729084921.767082-1-juerg.haefliger@canonical.com> References: <20220729084921.767082-1-juerg.haefliger@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" Derivatives might contain additional signed staging drivers so ensure that that list is processed as well when checking module signatures. Signed-off-by: Juerg Haefliger --- debian/rules.d/4-checks.mk | 3 +-- debian/scripts/module-signature-check | 23 ++++++++++++++++------- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/debian/rules.d/4-checks.mk b/debian/rules.d/4-checks.mk index ecc6b82aeab5..1d44bf9f02a0 100644 --- a/debian/rules.d/4-checks.mk +++ b/debian/rules.d/4-checks.mk @@ -15,8 +15,7 @@ module-signature-check-%: $(stampdir)/stamp-install-% @echo Debug: $@ $(DROOT)/scripts/module-signature-check "$*" \ "$(DROOT)/$(mods_pkg_name)-$*" \ - "$(DROOT)/$(mods_extra_pkg_name)-$*" \ - "$(DROOT)/signature-inclusion" + "$(DROOT)/$(mods_extra_pkg_name)-$*" # Check the reptoline jmp/call functions against the last release. retpoline-check-%: $(stampdir)/stamp-install-% diff --git a/debian/scripts/module-signature-check b/debian/scripts/module-signature-check index f28f4a89c913..80796b63e1be 100755 --- a/debian/scripts/module-signature-check +++ b/debian/scripts/module-signature-check @@ -3,17 +3,26 @@ flavor="${1}" mods_dir="${2}" mods_extra_dir="${3}" -sig_inc="${4}" echo "II: Checking signature of staging modules for ${flavor}..." -if [ -f "${sig_inc}" ] ; then - echo "II: Use signature inclusion file:" - echo " ${sig_inc}" +root=$(dirname "$(realpath -e "${0}")")/../.. +. "${root}"/debian/debian.env + +# Collect the signature-inclusion files +sig_incs=() +for d in debian "${DEBIAN}" ; do + if [ -f "${root}"/"${d}"/signature-inclusion ] ; then + sig_incs+=("${root}"/"${d}"/signature-inclusion) + fi +done + +if [ "${#sig_incs[@]}" -gt 0 ] ; then + echo "II: Use signature inclusion file(s):" + printf " %s\n" "${sig_incs[@]}" sig_all=0 else - echo "WW: Signature inclusion file missing:" - echo " ${sig_inc}" + echo "WW: Signature inclusion file(s) missing" echo "II: All modules must be signed" sig_all=1 fi @@ -43,7 +52,7 @@ while IFS= read -r mod ; do fi must=0 - if [ ${sig_all} -eq 1 ] || grep -qFx "${mod##*/}" "${sig_inc}" ; then + if [ ${sig_all} -eq 1 ] || grep -qFx "${mod##*/}" "${sig_incs[@]}" ; then # Module must be signed must=1 fi