Re: [gentoo-dev] [PATCH] linux-mod.eclass: support module signing

[Kenton Groombridge <concord@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1300 bytes --]

On 22/06/27 02:56PM, Mike Gilbert wrote:
> On Mon, Jun 27, 2022 at 2:35 PM Kenton Groombridge <concord@gentoo.org> wrote:
> > > so looks like we need to combine both methods and do the following:
> > >  - if signing requested without compression - sign in pkg_preinst.
> > >  - if signing requested with compression - sign in src_install
> > >
> >
> > Why can't we do both in pkg_preinst? I am thinking it would be best if
> > we drop the current compression implementation and rework your old code
> > to handle both compression and signing since the signing code is more or
> > less already complete.
> 
> Signing modules in pkg_preinst seems like a bad idea to me. That means
> you need to copy your private keys around to every host where the
> package might be installed.
> 
> If you sign in src_compile or src_install, you only need private keys
> on the system building your binpkg.
> 

Ah that makes sense. I think the question then is whether or not
building binpkgs for kernel modules where the target system has its own
signing keys is something we want to support.

With that in mind I realize that doing compression in pkg_preinst means
that target systems can use different compression methods (or no
compression at all) if desired without much complication.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 963 bytes --]