mailarchive of the ptxdist mailing list
 help / color / mirror / Atom feed
From: Michael Olbrich <m.olbrich@pengutronix.de>
To: Roland Hieber <rhi@pengutronix.de>
Cc: Marc Kleine-Budde <mkl@pengutronix.de>, ptxdist@pengutronix.de
Subject: Re: [ptxdist] [PATCH v3 1/5] ptxd_lib_code_signing: cs_get_ca(): improve error handling
Date: Fri, 9 Jul 2021 15:36:00 +0200	[thread overview]
Message-ID: <20210709133600.GB375046@pengutronix.de> (raw)
In-Reply-To: <20210708203941.30212-1-rhi@pengutronix.de>

On Thu, Jul 08, 2021 at 10:39:37PM +0200, Roland Hieber wrote:
> From: Marc Kleine-Budde <mkl@pengutronix.de>
> 
> This patch changes cs_get_ca() to only output the CA if it actually
> exists, or print an error and return 1 instead. This makes it possible
> to use make's $(if $(filter-out, ERROR_CA_NOT_YET_SET, ...))
> conditional.
> 
> Co-authored-by: Roland Hieber <rhi@pengutronix.de>
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
> Signed-off-by: Roland Hieber <rhi@pengutronix.de>
> ---
> PATCH v3:
>  - correctly check for existence of ${keydir} instead of ${ca} (feedback
>    from Michael Olbrich)
>  - drop controversial re-indentation patches 6/7 and 7/7 from the series
> 
> PATCH v2 (rhi): https://lore.ptxdist.org/ptxdist/20210627231121.28313-1-rhi@pengutronix.de
>  - reorder from PATCH 3/n to PATCH 1/n
>  - echo "ERROR_CA_NOT_YET_SET" in case of error (feedback from Michael
>    Olbrich) and also return 1
> 
> PATCH v1 (mkl): https://lore.ptxdist.org/ptxdist/20210412161900.2376802-3-mkl@pengutronix.de
> ---
>  scripts/lib/ptxd_lib_code_signing.sh | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/scripts/lib/ptxd_lib_code_signing.sh b/scripts/lib/ptxd_lib_code_signing.sh
> index 3e1654bb36e4..199f679ef828 100644
> --- a/scripts/lib/ptxd_lib_code_signing.sh
> +++ b/scripts/lib/ptxd_lib_code_signing.sh
> @@ -243,7 +243,13 @@ cs_get_ca() {
>      local role="${1}"
>      cs_init_variables
>  
> -    echo "${keydir}/${role}/ca.pem"
> +    local ca="${keydir}/${role}/ca.pem"
> +
> +    if [ ! -d "${keydir}" ]; then
> +	echo "ERROR_CA_NOT_YET_SET"
> +	return 1
> +    fi

So this is not what we want here. Sorry, I didn't notice this in the last
version. The idea is this:

If the keydir does not exist, then cs_get_ca)() was evaluated too early. So
the check above should be added as it is here.
What's now missing is what Marc originally intended and was part of the
first version of the patch:
If the keydir exists but no CA, then there will never be a CA and we want
to match that. So this should be there as well:

    if [ -e "${ca}" ]; then
	echo "${ca}"
    fi

instead of this:

> +    echo "${ca}"

Now we can do $(if $(shell cs_get_ca ...), ...) to do something only if the
CA exists.

Marc, that was the use-case, right?

Michael

>  }
>  export -f cs_get_ca
>  
> -- 
> 2.30.2
> 
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de


  parent reply	other threads:[~2021-07-09 13:36 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-08 20:39 Roland Hieber
2021-07-08 20:39 ` [ptxdist] [PATCH v3 2/5] ptxd_lib_code_signing: introduce role groups Roland Hieber
2021-07-20 11:48   ` [ptxdist] [APPLIED] " Michael Olbrich
2021-07-08 20:39 ` [ptxdist] [PATCH v3 3/5] templates/code-signing-provider: set up the 'imx-habv4-srk' role group Roland Hieber
2021-07-20 11:48   ` [ptxdist] [APPLIED] " Michael Olbrich
2021-07-08 20:39 ` [ptxdist] [PATCH v3 4/5] templates/barebox-imx-habv4: use " Roland Hieber
2021-07-20 11:48   ` [ptxdist] [APPLIED] " Michael Olbrich
2021-07-08 20:39 ` [ptxdist] [PATCH v3 5/5] host-ptx-code-signing-dev: version bump 0.4 -> 0.5 Roland Hieber
2021-07-20 11:48   ` [ptxdist] [APPLIED] " Michael Olbrich
2021-07-09 13:36 ` Michael Olbrich [this message]
2021-07-12  8:42   ` [ptxdist] [PATCH v3 1/5] ptxd_lib_code_signing: cs_get_ca(): improve error handling Marc Kleine-Budde
2021-07-13 11:51     ` [ptxdist] [PATCH v4] " Roland Hieber
2021-07-14  6:21       ` Michael Olbrich
2021-07-15 13:42         ` [ptxdist] [PATCH v5] " Roland Hieber
2021-07-20 11:49           ` [ptxdist] [APPLIED] " Michael Olbrich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210709133600.GB375046@pengutronix.de \
    --to=m.olbrich@pengutronix.de \
    --cc=mkl@pengutronix.de \
    --cc=ptxdist@pengutronix.de \
    --cc=rhi@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox