From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id E4DEF158094 for ; Mon, 27 Jun 2022 21:25:24 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 0CAEEE0C08; Mon, 27 Jun 2022 21:25:21 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 836F6E0C02 for ; Mon, 27 Jun 2022 21:25:20 +0000 (UTC) Message-ID: Subject: Re: [gentoo-dev] [PATCH] linux-mod.eclass: support module signing From: Georgy Yakovlev To: gentoo-dev@lists.gentoo.org Date: Mon, 27 Jun 2022 14:25:17 -0700 In-Reply-To: <20220627200255.bsikofgbnpc4lgjp@fuuko> References: <20220621181959.920941-1-concord@gentoo.org> <84e99a74d64f0d9dd326af0f2c54b9d5717b2f8d.camel@gentoo.org> <9317f3aa1815d9ef219625794c06a8fb3057d707.camel@gentoo.org> <20220627183531.palnmdpvgzf44ssk@fuuko> <20220627200255.bsikofgbnpc4lgjp@fuuko> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.44.2 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 X-Archives-Salt: 3d46644f-b589-43e3-8bd8-9bc81c321f10 X-Archives-Hash: 600e5103e64f2b633b55b8a09406b1a7 On Mon, 2022-06-27 at 16:02 -0400, Kenton Groombridge wrote: > > > Why can't we do both in pkg_preinst? I am thinking it would be > > > best > > > if > > > we drop the current compression implementation and rework your > > > old > > > code > > > to handle both compression and signing since the signing code is > > > more > > > or > > > less already complete. > >=20 > > i'm not sure if sign-file can sign compressed modules. >=20 > sign-file will not error when signing a compressed module, but the > kernel will not be able to load it. so we pretty much HAVE to strip->sign->compress, strictly in this order. nothing else will work. >=20 > > if we let kernel build handle compression - we have to sign prior > > to > > compression. > > if we compress modules ourselves then yes, we could sign first > > indeed. > >=20 > > but preinst has it's own issues, you've already seen floppym's > > remark. > >=20