From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-dev+bounces-97565-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id 98483158094
for <garchives@archives.gentoo.org>; Mon, 27 Jun 2022 18:56:27 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 09F18E08CD;
Mon, 27 Jun 2022 18:56:24 +0000 (UTC)
Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id A053DE0839
for <gentoo-dev@lists.gentoo.org>; Mon, 27 Jun 2022 18:56:23 +0000 (UTC)
Received: by mail-ed1-f49.google.com with SMTP id cf14so14376694edb.8
for <gentoo-dev@lists.gentoo.org>; Mon, 27 Jun 2022 11:56:22 -0700 (PDT)
X-Gm-Message-State: AJIora85hJW/pwUwO2afzZsa1k05PASnaYCp6Ms95vtn3FWy1nzYNeDx
jOdft3Oz+B22Xc0bOCOEImUhhAak3F1dshAH2ys=
X-Google-Smtp-Source: AGRyM1so01N3KQyXmhcIE4bEgvmhh7XoxSKMMLCrtwA42SrEfCsaMhjJ7GE+EN8YHiQyEAlRndBB9k2P3plzqV8FlN4=
X-Received: by 2002:aa7:c2cf:0:b0:435:6576:b7c0 with SMTP id
m15-20020aa7c2cf000000b004356576b7c0mr18762009edp.18.1656356180069; Mon, 27
Jun 2022 11:56:20 -0700 (PDT)
Precedence: bulk
List-Post: <mailto:gentoo-dev@lists.gentoo.org>
List-Help: <mailto:gentoo-dev+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-dev+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-dev+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-dev.gentoo.org>
X-BeenThere: gentoo-dev@lists.gentoo.org
Reply-to: gentoo-dev@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
MIME-Version: 1.0
References: <20220621181959.920941-1-concord@gentoo.org> <84e99a74d64f0d9dd326af0f2c54b9d5717b2f8d.camel@gentoo.org>
<9317f3aa1815d9ef219625794c06a8fb3057d707.camel@gentoo.org> <20220627183531.palnmdpvgzf44ssk@fuuko>
In-Reply-To: <20220627183531.palnmdpvgzf44ssk@fuuko>
From: Mike Gilbert <floppym@gentoo.org>
Date: Mon, 27 Jun 2022 14:56:08 -0400
X-Gmail-Original-Message-ID: <CAJ0EP410KN6BhtiiTWfd99pX4748zCS32DUNR5Fu8nM95LL_XA@mail.gmail.com>
Message-ID: <CAJ0EP410KN6BhtiiTWfd99pX4748zCS32DUNR5Fu8nM95LL_XA@mail.gmail.com>
Subject: Re: [gentoo-dev] [PATCH] linux-mod.eclass: support module signing
To: Gentoo Dev <gentoo-dev@lists.gentoo.org>
Content-Type: text/plain; charset="UTF-8"
X-Archives-Salt: fb5f7663-f77d-4671-98d1-414526c39125
X-Archives-Hash: 44350a54e1c01145ba883a36c5efc397
On Mon, Jun 27, 2022 at 2:35 PM Kenton Groombridge <concord@gentoo.org> wrote:
> > so looks like we need to combine both methods and do the following:
> > - if signing requested without compression - sign in pkg_preinst.
> > - if signing requested with compression - sign in src_install
> >
>
> Why can't we do both in pkg_preinst? I am thinking it would be best if
> we drop the current compression implementation and rework your old code
> to handle both compression and signing since the signing code is more or
> less already complete.
Signing modules in pkg_preinst seems like a bad idea to me. That means
you need to copy your private keys around to every host where the
package might be installed.
If you sign in src_compile or src_install, you only need private keys
on the system building your binpkg.