Commit d890f510c8e4 ("MODSIGN: Add modules_sign make target") introduced 'make modules_sign' to manually sign modules. Some time later, commit d9d8d7ed498e ("MODSIGN: Add option to not sign modules during modules_install") introduced CONFIG_MODULE_SIG_ALL. If it was disabled, mod_sign_cmd was set to no-op ('true' command). It affected not only 'make modules_install' but also 'make modules_sign'. With CONFIG_MODULE_SIG_ALL=n, neither modules_install nor modules_sign is able to sign modules. Kbuild has kept that behavior, and nobody has complained about it, but I think it is weird. CONFIG_MODULE_SIG_ALL=n should turn off signing only for modules_install. If users want to sign modules manually, modules_sign should be offered.
Showing the changes to scripts (1 of 1 file). Show all
Unified · Split
| @@ -95,7 +95,6 @@ endif · 94 unmodified lines | |||
| 95 | # Signing | 95 | # Signing |
| 96 | # Don't stop modules_install even if we can't sign external modules. | 96 | # Don't stop modules_install even if we can't sign external modules. |
| 97 | # | 97 | # |
| 98 | ifeq ($(CONFIG_MODULE_SIG_ALL),y) | ||
| 99 | ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),) | 98 | ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),) |
| 100 | sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY) | 99 | sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY) |
| 101 | else | 100 | else |
| @@ -104,13 +103,15 @@ endif · 2 unmodified lines | |||
| 104 | quiet_cmd_sign = SIGN $@ | 103 | quiet_cmd_sign = SIGN $@ |
| 105 | cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \ | 104 | cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \ |
| 106 | $(if $(KBUILD_EXTMOD),|| true) | 105 | $(if $(KBUILD_EXTMOD),|| true) |
| 107 | else | 106 | |
| 107 | ifeq ($(modules_sign_only),) | ||
| 108 | |||
| 109 | # During modules_install, modules are signed only when CONFIG_MODULE_SIG_ALL=y. | ||
| 110 | ifndef CONFIG_MODULE_SIG_ALL | ||
| 108 | quiet_cmd_sign := | 111 | quiet_cmd_sign := |
| 109 | cmd_sign := : | 112 | cmd_sign := : |
| 110 | endif | 113 | endif |
| 111 | 114 | ||
| 112 | ifeq ($(modules_sign_only),) | ||
| 113 | |||
| 114 | # Create necessary directories | 115 | # Create necessary directories |
| 115 | $(shell mkdir -p $(sort $(dir $(install-y)))) | 116 | $(shell mkdir -p $(sort $(dir $(install-y)))) |
| 116 | 117 | ||