From patchwork Fri Jul 29 08:49:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Juerg Haefliger X-Patchwork-Id: 1661924 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=dxQCROAG; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4LvLmY1NWWz9sGH for ; Fri, 29 Jul 2022 18:49:32 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1oHLgT-0007PQ-NY; Fri, 29 Jul 2022 08:49:25 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1oHLgS-0007Ov-DN for kernel-team@lists.ubuntu.com; Fri, 29 Jul 2022 08:49:24 +0000 Received: from mail-ej1-f70.google.com (mail-ej1-f70.google.com [209.85.218.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 19A123F119 for ; Fri, 29 Jul 2022 08:49:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1659084564; bh=8QQZGSAbt4dP2ARmsH7NKsr2OMNBzNy2oKHJOGBdfBs=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=dxQCROAGM46Lh5xZe4wD2LRj76Cs3bihNLhM4tMqdG72CFOWuuxNBQmqOmpOw8BEv 93gF1NHXWTd2oIPUelRYDyXHBmdzKaj0ZDb8rpF1S518aOa5dvMM6oJzAnOhpkyMU7 JaL2Gp7auGhjR21o+MfOHW2J+1lZz2H60EUCcKNydcFnjVxt9EpxoiPtCBgbIUpEbw SEkVedvIyLcmxbj7ItFuH/Y3S9tER2hiKc1QAXkDgJOCURYu7400vhuxOWHnvU8GN3 SRjWN6cyie6U8Asa7ZqOaiGKdCk/oxZ6X/f2Br6WbBLBNsiOvnr31dJ4DATvyLj3bW 824otXGUszXxA== Received: by mail-ej1-f70.google.com with SMTP id hv22-20020a17090760d600b0072f2cce7d10so1543302ejc.19 for ; Fri, 29 Jul 2022 01:49:24 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc; bh=8QQZGSAbt4dP2ARmsH7NKsr2OMNBzNy2oKHJOGBdfBs=; b=ENy3lzHRagea2AapiDSWCiQSVt3HkSI2zMWDDflGHHGQzXFyvgNTGTBU+W2TCWJIGH rxzAO3PMH3WOyIsmmLOdjEqvdSK+X0SEJ2XUJnUPkDET9NkoPgOw6KvZ5FVbdtK9+eRY 2+tmpEkzzlxwSPa4yqxfluDAs5KvhlNrtE5d3p9xQsMmPUDrCc5tnfjDvjLvWTzlWI66 TxUCDxYjRodctTavrokUQgjoq8tekHG/E19jrYoXZBROddjtPlT+Sg/qyXfkTyz/hpkP Abu3tieBRq2pNnHMBhb3co4vH/ku2CUC6PhbXJXxws8ULfe5O/lltH69kfAF/jf/jdt4 jhrw== X-Gm-Message-State: AJIora+TgQm8Luy2ADpOLwuc4V6kAq7sdxWvRw4p8PFBES52KLPZI730 zIIVjOcjnnbee8gPMfrGCg4Ra+r8bCEd33YlwhCsKsVAOCWfmFhr/REXNcmhmHqcpAiwXHNB9CR jm/mYEDS4/46p9jVZKLpfIbiIfpAn4mY2KTC4j4LulQ== X-Received: by 2002:aa7:da83:0:b0:43c:abc2:fffb with SMTP id q3-20020aa7da83000000b0043cabc2fffbmr2506082eds.396.1659084563849; Fri, 29 Jul 2022 01:49:23 -0700 (PDT) X-Google-Smtp-Source: AGRyM1sztjDinlIEoomjTTH/HC1023pkC9p1dDn9PgvkN48MEu5DQgt6PRPwfpG/ydQU7oiokjitQg== X-Received: by 2002:aa7:da83:0:b0:43c:abc2:fffb with SMTP id q3-20020aa7da83000000b0043cabc2fffbmr2506067eds.396.1659084563573; Fri, 29 Jul 2022 01:49:23 -0700 (PDT) Received: from gollum.fritz.box ([194.191.244.86]) by smtp.gmail.com with ESMTPSA id w6-20020a1709064a0600b0072aa38d768esm1413949eju.64.2022.07.29.01.49.22 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 Jul 2022 01:49:22 -0700 (PDT) From: Juerg Haefliger To: kernel-team@lists.ubuntu.com Subject: [unstable/kinetic][PATCH 1/3] UBUNTU: [Packaging] module-signature-check: Check debian./signature-inclusion Date: Fri, 29 Jul 2022 10:49:19 +0200 Message-Id: <20220729084921.767082-2-juerg.haefliger@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220729084921.767082-1-juerg.haefliger@canonical.com> References: <20220729084921.767082-1-juerg.haefliger@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" Derivatives might contain additional signed staging drivers so ensure that that list is processed as well when checking module signatures. Signed-off-by: Juerg Haefliger --- debian/rules.d/4-checks.mk | 3 +-- debian/scripts/module-signature-check | 23 ++++++++++++++++------- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/debian/rules.d/4-checks.mk b/debian/rules.d/4-checks.mk index ecc6b82aeab5..1d44bf9f02a0 100644 --- a/debian/rules.d/4-checks.mk +++ b/debian/rules.d/4-checks.mk @@ -15,8 +15,7 @@ module-signature-check-%: $(stampdir)/stamp-install-% @echo Debug: $@ $(DROOT)/scripts/module-signature-check "$*" \ "$(DROOT)/$(mods_pkg_name)-$*" \ - "$(DROOT)/$(mods_extra_pkg_name)-$*" \ - "$(DROOT)/signature-inclusion" + "$(DROOT)/$(mods_extra_pkg_name)-$*" # Check the reptoline jmp/call functions against the last release. retpoline-check-%: $(stampdir)/stamp-install-% diff --git a/debian/scripts/module-signature-check b/debian/scripts/module-signature-check index f28f4a89c913..80796b63e1be 100755 --- a/debian/scripts/module-signature-check +++ b/debian/scripts/module-signature-check @@ -3,17 +3,26 @@ flavor="${1}" mods_dir="${2}" mods_extra_dir="${3}" -sig_inc="${4}" echo "II: Checking signature of staging modules for ${flavor}..." -if [ -f "${sig_inc}" ] ; then - echo "II: Use signature inclusion file:" - echo " ${sig_inc}" +root=$(dirname "$(realpath -e "${0}")")/../.. +. "${root}"/debian/debian.env + +# Collect the signature-inclusion files +sig_incs=() +for d in debian "${DEBIAN}" ; do + if [ -f "${root}"/"${d}"/signature-inclusion ] ; then + sig_incs+=("${root}"/"${d}"/signature-inclusion) + fi +done + +if [ "${#sig_incs[@]}" -gt 0 ] ; then + echo "II: Use signature inclusion file(s):" + printf " %s\n" "${sig_incs[@]}" sig_all=0 else - echo "WW: Signature inclusion file missing:" - echo " ${sig_inc}" + echo "WW: Signature inclusion file(s) missing" echo "II: All modules must be signed" sig_all=1 fi @@ -43,7 +52,7 @@ while IFS= read -r mod ; do fi must=0 - if [ ${sig_all} -eq 1 ] || grep -qFx "${mod##*/}" "${sig_inc}" ; then + if [ ${sig_all} -eq 1 ] || grep -qFx "${mod##*/}" "${sig_incs[@]}" ; then # Module must be signed must=1 fi From patchwork Fri Jul 29 08:49:20 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Juerg Haefliger X-Patchwork-Id: 1661926 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=cSnV4hgm; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4LvLmZ1BX3z9sV6 for ; Fri, 29 Jul 2022 18:49:34 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1oHLgV-0007QU-Tn; Fri, 29 Jul 2022 08:49:27 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1oHLgT-0007PI-E8 for kernel-team@lists.ubuntu.com; Fri, 29 Jul 2022 08:49:25 +0000 Received: from mail-ed1-f71.google.com (mail-ed1-f71.google.com [209.85.208.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 386BD3F122 for ; Fri, 29 Jul 2022 08:49:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1659084565; bh=bHMCg7ucJYGIssn8ikrZdfKstECI3RCLlyBUt+A+iKk=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=cSnV4hgmaYyztqBykjaF9PtqkBtejcNcQ6NBEJduQVSQe56Q232mfPccLCujUPslw fiEujtLuq2LIc+VsODV2kxVN/M3xtqR0VPROf3P+5CfcYMVUWXkMO/YrQ2YCe+Hby1 6CVrLkWfK/EKqdmzgjwd0haLUhdNxo6YbKdsgvXe+UaL5rTcB2A1WkuSqs5KEw5zF2 FahprsSgUlBA2g45hf0q26dxnlBJB7CSublK8X+1u4t9IpA4ULjltbHxP0jWF26gWZ nC4d0jWNiZp6OAUau4NE+j8vGzMfct3Svivs8UmqcwbNL6wn1U8YSas4XJRt1poetQ pGof6+MZStayQ== Received: by mail-ed1-f71.google.com with SMTP id s17-20020a056402521100b0043ade613038so2553033edd.17 for ; Fri, 29 Jul 2022 01:49:25 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc; bh=bHMCg7ucJYGIssn8ikrZdfKstECI3RCLlyBUt+A+iKk=; b=IgvV+8qYLcOOFPGa9XUORSvg4qZ1++eXK+x0eLMWLKNvTXD6As8mKKIOryGDByhZrw cKS5aMwAYMlO2EOPILpRT6jF0VeixkFCm5As5M9zvn2uZoDp4OCfo6ZQlO7KTjmQgOWn BUhda4SZGPExpdG3iQyps4RldiTNMtj2GGeSUT75t1ddNHjZ0BMb5dzL5WTi+gXY6C3a /f01S7voj8HB5Nc45ApLQ1TBG38RpUW8Kzp/aiEOxFOMlMQA/L63QftcrzAHMSsaVUXY 85HTbWlEyO0AM41nKuajRIjqEEAP68IWVUXCBJF30VRMbSG04/IyUByAxYy6yePGBZrR 8NNg== X-Gm-Message-State: AJIora9k7pIZgmvZ3L5pCfZkTeuwWxRC9ipdo0qwtOv0u1ZuxYaQLbST NpJuttouOTl6plzEZPzPhQarp1qTzeWy8ohLHlPrJyi0wa1FBT4arMyYeuhTwowhZ8QAfo/7tiY ReJ0OdyR/i9xBonk58lBQFuhxWlyrTg7pYdxzSVHvNA== X-Received: by 2002:aa7:d345:0:b0:43b:c6ae:6b38 with SMTP id m5-20020aa7d345000000b0043bc6ae6b38mr2463671edr.235.1659084565069; Fri, 29 Jul 2022 01:49:25 -0700 (PDT) X-Google-Smtp-Source: AGRyM1uGFPFoiJYJLobIbKSetbeu4VtKg6ItZYb49XBYLjt2Fs2+MAwvkQqNMvQL9Nn2hOT8EPFDTg== X-Received: by 2002:aa7:d345:0:b0:43b:c6ae:6b38 with SMTP id m5-20020aa7d345000000b0043bc6ae6b38mr2463651edr.235.1659084564778; Fri, 29 Jul 2022 01:49:24 -0700 (PDT) Received: from gollum.fritz.box ([194.191.244.86]) by smtp.gmail.com with ESMTPSA id w6-20020a1709064a0600b0072aa38d768esm1413949eju.64.2022.07.29.01.49.23 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 Jul 2022 01:49:24 -0700 (PDT) From: Juerg Haefliger To: kernel-team@lists.ubuntu.com Subject: [unstable/kinetic][PATCH 2/3] UBUNTU: [Packaging] Introduce debian/scripts/sign-module Date: Fri, 29 Jul 2022 10:49:20 +0200 Message-Id: <20220729084921.767082-3-juerg.haefliger@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220729084921.767082-1-juerg.haefliger@canonical.com> References: <20220729084921.767082-1-juerg.haefliger@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" Move the logic that determines if a module needs to be signed to a script and extend it to also check the signature-inclusion list of derivatives. Signed-off-by: Juerg Haefliger --- debian/scripts/sign-module | 40 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100755 debian/scripts/sign-module diff --git a/debian/scripts/sign-module b/debian/scripts/sign-module new file mode 100755 index 000000000000..03ce543de7f8 --- /dev/null +++ b/debian/scripts/sign-module @@ -0,0 +1,40 @@ +#!/bin/bash -eu +# +# Staging drivers must not be signed if they are not listed in a +# signature-inclusion file to prevent loading of 'unsafe' drivers in a +# Secure Boot environment. +# +# Exit with status 0 if the provided module needs to be signed, 1 otherwise +# + +mod=${1} + +# Sign the module if not a staging driver +if [ "${mod/\/drivers\/staging\//}" = "${mod}" ] ; then + exit 0 +fi + +root=$(dirname "$(realpath -e "${0}")")/../.. +. "${root}"/debian/debian.env + +# Collect the signature-inclusion files +sig_incls=() +for d in debian "${DEBIAN}" ; do + if [ -f "${root}"/"${d}"/signature-inclusion ] ; then + sig_incls+=("${root}"/"${d}"/signature-inclusion) + fi +done + +# Sign the module if no signature-inclusion files +if [ ${#sig_incls[@]} -eq 0 ] ; then + exit 0 +fi + +# Sign the module if listed in signature-inclusion files +if grep -qFx "${mod##*/}" "${sig_incls[@]}" ; then + exit 0 +fi + +# Don't sign the module +echo "UBUNTU: Not signing ${1}" +exit 1 From patchwork Fri Jul 29 08:49:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Juerg Haefliger X-Patchwork-Id: 1661927 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=L3JZHj39; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4LvLmd4qbCz9sGH for ; Fri, 29 Jul 2022 18:49:37 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1oHLgZ-0007Tp-3H; Fri, 29 Jul 2022 08:49:31 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1oHLgW-0007Qs-8F for kernel-team@lists.ubuntu.com; Fri, 29 Jul 2022 08:49:28 +0000 Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 494433F122 for ; Fri, 29 Jul 2022 08:49:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1659084566; bh=RcVaLgkgKQlhtgXdKk7QgoIRdndp6+/N1UI+y8kWiVE=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=L3JZHj39UtH6Iif2Y9461N7pXQbPl5UeP69BauS0Ol95cNKY0qp6l2HNyA7fhn2Nw 3vyPUSBselsCHGr+2ySkFL1aghiDTPTpmo0p/l1Fa/Lf0ESS0lqri6nO7+VOr8Aci1 tLAn3euGvqvqHW9t29ah4c/FTvMwZy/HqSkrSdmz5rgFkFoWTcmaVitA5Rta79OQg3 cQh4vLkn4mSOUIGx56Bt97bwUDNC1dSIkqzkYfWEto1ltcqelM3t5nFDETt+tyTU+r Fn8aMZleaTu7m44BR6a5P2K5U1x+rCGf4wOjuKKp2bXVc7UgXSSbQjWSPm6aWiS1qk WCOlmbuhxLr5g== Received: by mail-ed1-f72.google.com with SMTP id g15-20020a056402424f00b0043bff7a68dbso2535478edb.10 for ; Fri, 29 Jul 2022 01:49:26 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc; bh=RcVaLgkgKQlhtgXdKk7QgoIRdndp6+/N1UI+y8kWiVE=; b=ep9LWPEoJ+IrlvP7T18VLchkh8XPK/raz+gjanRHO9IzcFU0ggVvayM14u69F8Jhv4 Wu0LqacWxVdOdpCUgWdBGBdMjBPc+Dcj3/JB8gF0+a7lB39u8hCDniMAYm5LwQ0Urxq6 ksoxTIRM+2BiRaKlDnPRK4da/gTaL3LtjXOqwfSxT+dlUYTpjKORLZYn9LOQ4YQJdmu7 5NhKPYwn8zohuhCYbsQyESSeNpzjHLSpGBibQpS43pwIqpErXclL2kEQAVsN+h1BGW9H tUmGoYVzIwKuldOUMs4xiu712OFqEQL6HJ8gFX59YLUVDTjMwbDBh92E93OPtYg1kCyF 3wlg== X-Gm-Message-State: AJIora/5Au51RcXL/jPmZflObrud66bSLSIIn13GsT/OvEKq8YxS14sU kZBiwKjsNpSmdnJEj2IQbVrMr6I+7RfQyhwK18CMmL1Q0vcrw27XsBoLivFW1+Klqbg2BXs6+fx AXc2ErKOoi9yWm0X3HswhOBxJGrNbSCM2C9itPU/k5g== X-Received: by 2002:a05:6402:42c6:b0:43b:f475:a9ed with SMTP id i6-20020a05640242c600b0043bf475a9edmr2515940edc.150.1659084566039; Fri, 29 Jul 2022 01:49:26 -0700 (PDT) X-Google-Smtp-Source: AGRyM1txp59qdwzRhe0OxgWUl3qcXLyEAZ9AiL5MKyyiq23Pd6pQB/txyu3zAkXK+nRuy1Uv1s7TYg== X-Received: by 2002:a05:6402:42c6:b0:43b:f475:a9ed with SMTP id i6-20020a05640242c600b0043bf475a9edmr2515927edc.150.1659084565735; Fri, 29 Jul 2022 01:49:25 -0700 (PDT) Received: from gollum.fritz.box ([194.191.244.86]) by smtp.gmail.com with ESMTPSA id w6-20020a1709064a0600b0072aa38d768esm1413949eju.64.2022.07.29.01.49.24 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 Jul 2022 01:49:25 -0700 (PDT) From: Juerg Haefliger To: kernel-team@lists.ubuntu.com Subject: [unstable/kinetic][PATCH 3/3] UBUNTU: SAUCE: Switch to using debian/scripts/sign-module Date: Fri, 29 Jul 2022 10:49:21 +0200 Message-Id: <20220729084921.767082-4-juerg.haefliger@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220729084921.767082-1-juerg.haefliger@canonical.com> References: <20220729084921.767082-1-juerg.haefliger@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" Use the new script debian/scripts/sign-module to determine if a modules needs to be signed. Signed-off-by: Juerg Haefliger --- scripts/Makefile.modinst | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst index 0c4e808ecb84..89d5973e4743 100644 --- a/scripts/Makefile.modinst +++ b/scripts/Makefile.modinst @@ -65,11 +65,9 @@ endif ifeq ($(CONFIG_MODULE_SIG_ALL),y) sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY) quiet_cmd_sign = SIGN $@ - cmd_sign = if echo "$@" | grep -qF "/drivers/staging/" && \ - test -f $(srctree)/debian/signature-inclusion && \ - ! grep -qFx "$(notdir $@)" $(srctree)/debian/signature-inclusion ; \ - then echo "UBUNTU: Not signing $@" ; \ - else scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(sig-key) certs/signing_key.x509 $@ \ + cmd_sign = if test -e $(srctree)/debian/scripts/sign-module && \ + $(srctree)/debian/scripts/sign-module $@ ; \ + then scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(sig-key) certs/signing_key.x509 $@ \ $(if $(KBUILD_EXTMOD),|| true) ; \ fi else