gentoo-mirror/gentoo
1
0
Fork 0
mirror of https://github.com/gentoo-mirror/gentoo.git synced 2026-09-24 04:59:14 -07:00
Code Issues Projects Releases Wiki Activity

kernel-build.eclass: do not override MODULES_SIGN_KEY with temp key

Browse Source 
The kernel build system expects the module signing key and
certificate in one file. In order to accommodate this we merge the
MODULES_SIGN_KEY and MODULES_SIGN_CERT into a temporary key in $T.

However, in doing so we override the MODULES_SIGN_KEY variable (but
not the MODULES_SIGN_CERT variable). This becomes a problem when
merging binpkgs because then the MODULES_SIGN_KEY variable points to
a temporary signing key that does not exist (whereas the untouched
MODULES_SIGN_CERT does exist). Usually this is not an issue except if
the MODULES_SIGN_KEY is to be used later in the binpkg merging process
such as is the case in, for example, the dkms installkernel hook.

Here we resolve this unfortunate situation by using a local variable
during the config merging process and not touching the original
MODULES_SIGN_KEY. Therefore, the MODULES_SIGN_KEY will now also
point us to an existing key if we are merging a binpkg of the kernel.

Signed-off-by: Nowa Ammerlaan <nowa@gentoo.org>
Closes: https://github.com/gentoo/gentoo/pull/41286
Signed-off-by: Nowa Ammerlaan <nowa@gentoo.org>
This commit is contained in:
Nowa Ammerlaan
2025-03-25 19:41:07 +01:00
parent 37be7e4305
commit 0ef4b71c4d
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
eclass/kernel-build.eclass
View File

@@ -741,18 +741,19 @@ kernel-build_merge_configs() {
fi
if [[ ${KERNEL_IUSE_MODULES_SIGN} ]] && use modules-sign; then
local modules_sign_key=${MODULES_SIGN_KEY}
if [[ -n ${MODULES_SIGN_KEY_CONTENTS} ]]; then
(umask 066 && touch "${T}/kernel_key.pem" || die)
echo "${MODULES_SIGN_KEY_CONTENTS}" > "${T}/kernel_key.pem" || die
modules_sign_key="${T}/kernel_key.pem"
(umask 066 && touch "${modules_sign_key}" || die)
echo "${MODULES_SIGN_KEY_CONTENTS}" > "${modules_sign_key}" || die
unset MODULES_SIGN_KEY_CONTENTS
export MODULES_SIGN_KEY="${T}/kernel_key.pem"
fi
if [[ ${MODULES_SIGN_KEY} == pkcs11:* || -r ${MODULES_SIGN_KEY} ]]; then
echo "CONFIG_MODULE_SIG_KEY=\"${MODULES_SIGN_KEY}\"" \
if [[ ${modules_sign_key} == pkcs11:* || -r ${modules_sign_key} ]]; then
echo "CONFIG_MODULE_SIG_KEY=\"${modules_sign_key}\"" \
>> "${WORKDIR}/modules-sign-key.config"
merge_configs+=( "${WORKDIR}/modules-sign-key.config" )
elif [[ -n ${MODULES_SIGN_KEY} ]]; then
die "MODULES_SIGN_KEY=${MODULES_SIGN_KEY} not found or not readable!"
elif [[ -n ${modules_sign_key} ]]; then
die "MODULES_SIGN_KEY=${modules_sign_key} not found or not readable!"
fi
fi