gentoo-mirror/gentoo
1
0
Fork 0
mirror of https://github.com/gentoo-mirror/gentoo.git synced 2026-09-24 04:59:14 -07:00
Code Issues Projects Releases Wiki Activity

kernel-build.eclass: copy module signing key to tempdir in pkg_setup

Browse Source 
Previously, it was being copied in src_prepare, and thus would fail if
the signing key was not readable by portage:portage. This commit makes
kernel-build.eclass instead copy the signing key in pkg_setup, and then
correct the permissions.

Signed-off-by: Violet Purcell <vimproved@inventati.org>
Closes: https://github.com/gentoo/gentoo/pull/33850
Signed-off-by: Andrew Ammerlaan <andrewammerlaan@gentoo.org>
This commit is contained in:
Violet Purcell
2023-11-16 12:23:16 -05:00
committed by Andrew Ammerlaan
parent 31168cb79e
commit d03c14cd4b
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
eclass/kernel-build.eclass
View File

@@ -114,6 +114,16 @@ kernel-build_pkg_setup() {
python-any-r1_pkg_setup
if [[ ${KERNEL_IUSE_MODULES_SIGN} ]]; then
secureboot_pkg_setup
if [[ -e ${MODULES_SIGN_KEY} && ${MODULES_SIGN_KEY} != pkcs11:* ]]; then
if [[ -e ${MODULES_SIGN_CERT} && ${MODULES_SIGN_CERT} != ${MODULES_SIGN_KEY} ]]; then
cat "${MODULES_SIGN_CERT}" "${MODULES_SIGN_KEY}" > "${T}/kernel_key.pem" || die
else
cp "${MODULES_SIGN_KEY}" "${T}/kernel_key.pem" || die
fi
chown portage:portage "${T}/kernel_key.pem" || die
chmod 0400 "${T}/kernel_key.pem" || die
export MODULES_SIGN_KEY="${T}/kernel_key.pem"
fi
fi
}
@@ -427,13 +437,6 @@ kernel-build_merge_configs() {
CONFIG_MODULE_SIG_FORCE=y
CONFIG_MODULE_SIG_${MODULES_SIGN_HASH^^}=y
EOF
if [[ -e ${MODULES_SIGN_KEY} && -e ${MODULES_SIGN_CERT} &&
${MODULES_SIGN_KEY} != ${MODULES_SIGN_CERT} &&
${MODULES_SIGN_KEY} != pkcs11:* ]]
then
cat "${MODULES_SIGN_CERT}" "${MODULES_SIGN_KEY}" > "${T}/kernel_key.pem" || die
MODULES_SIGN_KEY="${T}/kernel_key.pem"
fi
if [[ ${MODULES_SIGN_KEY} == pkcs11:* || -r ${MODULES_SIGN_KEY} ]]; then
echo "CONFIG_MODULE_SIG_KEY=\"${MODULES_SIGN_KEY}\"" \
>> "${WORKDIR}/modules-sign.config"