Re: [gentoo-dev] [PATCH] linux-mod.eclass: support module signing

[Mike Gilbert <floppym@gentoo.org>]

On Tue, Jul 5, 2022 at 3:02 PM Georgy Yakovlev <gyakovlev@gentoo.org> wrote:
>
> ...snip
> >
> > > In that case, I think the only viable way to make this work is to
> > > disable automatic stripping and handle stripping via custom code in
> > > the ebuild/eclass.
> > >
> > might work indeed if we do something like (pseudo-bash)
> >
> > if [[ module_sign == yes ]]; then
> >     dostrip -x /lib/modules # to stop portage stripping .ko objects
> >     manual-strip-respecting-features-nostrip -r /lib/modules
> >     sign-all-modules -r /lib/modules
> > fi
> > [[ compress_modules == yes ]] && compress-modules -r /lib/modules
> >
> >
> > this will equire eapi-bumping couple of packages
> > https://qa-reports.gentoo.org/output/eapi-per-eclass/linux-mod.eclass/6.txt
> > and restricting linux-mod.eclass to eapi7 or later.
> >
> >
> >
> started playing with my old code and got blocked right away:
>
> looks like dostrip just creates a list of files/directories to strip
> and processed at the very end of install phase.
>
> so skipping strip and doing manual one might be problematic.
> internally portage uses estrip
> https://github.com/gentoo/portage/blob/master/bin/estrip
> which contains quite a lot of logic and code and I don't think
> partially re-implementing this in eclass code is appropriate.
>

Looking at the kernel build system, it looks like modules don't get
stripped by default anyway: you have to explicitly pass
INSTALL_MOD_STRIP=1 to make modules_install.

I don't think it would be a major problem to just disable stripping
entirely for out-of-tree modules when module signing is enabled.

Alternatively, forget about trying to reimplement estrip and just
strip the files by calling ${STRIP} --strip-debug, as is done in
scripts/Makefile.modinst in the kernel sources. That will conflict
with FEATURES=splitdebug, but I doubt that's very useful for kernel
developers anyway.