Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d9d8d7ed authored by Michal Marek's avatar Michal Marek Committed by Rusty Russell
Browse files

MODSIGN: Add option to not sign modules during modules_install 



To allow the builder to sign only a subset of modules, or to sign the
modules using a key that is not available on the build machine, add
CONFIG_MODULE_SIG_ALL. If this option is unset, no modules will be
signed during build. The default is 'y', to preserve the current
behavior.

Signed-off-by: default avatarMichal Marek <mmarek@suse.cz>
Acked-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
parent 1c37c054

Makefile

+1 −1
Original line number Diff line number Diff line
@@ -719,7 +719,7 @@ endif # INSTALL_MOD_STRIP 
export mod_strip_cmd





ifeq ($(CONFIG_MODULE_SIG),y)

ifdef CONFIG_MODULE_SIG_ALL

MODSECKEY = ./signing_key.priv

MODPUBKEY = ./signing_key.x509

export MODPUBKEY

init/Kconfig

+11 −0
Original line number Diff line number Diff line
@@ -1665,6 +1665,17 @@ config MODULE_SIG_FORCE 
	  Reject unsigned modules or signed modules for which we don't have a

	  key.  Without this, such modules will simply taint the kernel.



config MODULE_SIG_ALL

	bool "Automatically sign all modules"

	default y

	depends on MODULE_SIG

	help

	  Sign all modules during make modules_install. Without this option,

	  modules must be signed manually, using the scripts/sign-file tool.



comment "Do not forget to sign required modules with scripts/sign-file"

	depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL



choice

	prompt "Which hash algorithm should modules be signed with?"

	depends on MODULE_SIG