From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 98483158094 for ; Mon, 27 Jun 2022 18:56:27 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 09F18E08CD; Mon, 27 Jun 2022 18:56:24 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id A053DE0839 for ; Mon, 27 Jun 2022 18:56:23 +0000 (UTC) Received: by mail-ed1-f49.google.com with SMTP id cf14so14376694edb.8 for ; Mon, 27 Jun 2022 11:56:22 -0700 (PDT) X-Gm-Message-State: AJIora85hJW/pwUwO2afzZsa1k05PASnaYCp6Ms95vtn3FWy1nzYNeDx jOdft3Oz+B22Xc0bOCOEImUhhAak3F1dshAH2ys= X-Google-Smtp-Source: AGRyM1so01N3KQyXmhcIE4bEgvmhh7XoxSKMMLCrtwA42SrEfCsaMhjJ7GE+EN8YHiQyEAlRndBB9k2P3plzqV8FlN4= X-Received: by 2002:aa7:c2cf:0:b0:435:6576:b7c0 with SMTP id m15-20020aa7c2cf000000b004356576b7c0mr18762009edp.18.1656356180069; Mon, 27 Jun 2022 11:56:20 -0700 (PDT) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 References: <20220621181959.920941-1-concord@gentoo.org> <84e99a74d64f0d9dd326af0f2c54b9d5717b2f8d.camel@gentoo.org> <9317f3aa1815d9ef219625794c06a8fb3057d707.camel@gentoo.org> <20220627183531.palnmdpvgzf44ssk@fuuko> In-Reply-To: <20220627183531.palnmdpvgzf44ssk@fuuko> From: Mike Gilbert Date: Mon, 27 Jun 2022 14:56:08 -0400 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [gentoo-dev] [PATCH] linux-mod.eclass: support module signing To: Gentoo Dev Content-Type: text/plain; charset="UTF-8" X-Archives-Salt: fb5f7663-f77d-4671-98d1-414526c39125 X-Archives-Hash: 44350a54e1c01145ba883a36c5efc397 On Mon, Jun 27, 2022 at 2:35 PM Kenton Groombridge wrote: > > so looks like we need to combine both methods and do the following: > > - if signing requested without compression - sign in pkg_preinst. > > - if signing requested with compression - sign in src_install > > > > Why can't we do both in pkg_preinst? I am thinking it would be best if > we drop the current compression implementation and rework your old code > to handle both compression and signing since the signing code is more or > less already complete. Signing modules in pkg_preinst seems like a bad idea to me. That means you need to copy your private keys around to every host where the package might be installed. If you sign in src_compile or src_install, you only need private keys on the system building your binpkg.