Commit d890f510c8e4 ("MODSIGN: Add modules_sign make target") introduced 'make modules_sign' to manually sign modules. Some time later, commit d9d8d7ed498e ("MODSIGN: Add option to not sign modules during modules_install") introduced CONFIG_MODULE_SIG_ALL. If it was disabled, mod_sign_cmd was set to no-op ('true' command). It affected not only 'make modules_install' but also 'make modules_sign'. With CONFIG_MODULE_SIG_ALL=n, neither modules_install nor modules_sign is able to sign modules. Kbuild has kept that behavior, and nobody has complained about it, but I think it is weird. CONFIG_MODULE_SIG_ALL=n should turn off signing only for modules_install. If users want to sign modules manually, modules_sign should be offered.
Showing the changes to scripts (1 of 1 file). Show all
Unified · Split
| @@ -95,7 +95,6 @@ endif · 94 unmodified lines | ||
| 95 | 95 | # Signing |
| 96 | 96 | # Don't stop modules_install even if we can't sign external modules. |
| 97 | 97 | # |
| 98 | −ifeq ($(CONFIG_MODULE_SIG_ALL),y) | |
| 99 | 98 | ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),) |
| 100 | 99 | sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY) |
| 101 | 100 | else |
| @@ -104,13 +103,15 @@ endif · 2 unmodified lines | ||
| 104 | 103 | quiet_cmd_sign = SIGN $@ |
| 105 | 104 | cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \ |
| 106 | 105 | $(if $(KBUILD_EXTMOD),|| true) |
| 107 | −else | |
| 106 | + | |
| 107 | +ifeq ($(modules_sign_only),) | |
| 108 | + | |
| 109 | +# During modules_install, modules are signed only when CONFIG_MODULE_SIG_ALL=y. | |
| 110 | +ifndef CONFIG_MODULE_SIG_ALL | |
| 108 | 111 | quiet_cmd_sign := |
| 109 | 112 | cmd_sign := : |
| 110 | 113 | endif |
| 111 | 114 | |
| 112 | −ifeq ($(modules_sign_only),) | |
| 113 | − | |
| 114 | 115 | # Create necessary directories |
| 115 | 116 | $(shell mkdir -p $(sort $(dir $(install-y)))) |
| 116 | 117 | |