Re: [ptxdist] [PATCH v2 5/5] ptxd_lib_code_signing: add key whitelist checks

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Sun, Sep 12, 2021 at 10:33:29PM +0200, Roland Hieber wrote:
> On Wed, Sep 08, 2021 at 01:43:59PM +0200, Roland Hieber wrote:
> > On Fri, Sep 03, 2021 at 03:17:13PM +0200, Michael Olbrich wrote:
> > > On Mon, Aug 09, 2021 at 10:06:08AM +0200, Roland Hieber wrote:
> > > > diff --git a/rules/pre/030-code-signing-consumers.make b/rules/pre/030-code-signing-consumers.make
> > > > index 909e8ebd6936..bca05854372d 100644
> > > > --- a/rules/pre/030-code-signing-consumers.make
> > > > +++ b/rules/pre/030-code-signing-consumers.make
> > > > @@ -28,6 +28,9 @@ $(strip \
> > > >  		$(call ptx/cs-consumer-env, $(1))\
> > > >  			cs_get_uri '$(strip $(2))'\
> > > >  	)\
> > > > +	$(if $(filter-out 0,$(.SHELLSTATUS)),\
> > > > +		$(call ptx/error, cs-get-uri: whitelist check failed – see errors above)\
> > > > +	)\
> > > 
> > > You cannot use ptx/error here. That macro can only be used for stuff that
> > > is evaluated before the first target is executed. Otherwise the error
> > > message will get lost.
> > > You need to use $(error ...) here. Probably with the same $(shell :) hack
> > > that is used in kernel.make.
> > 
> > Okay.
> 
> The $(shell :) hack was apparently not necessary, but there was some

Are you sure? The difference is only visible, for quiet parallel builds, I
think.

Michael

> fallout; as soon as I changed it to $(error), I noticed that it errors
> all over the place when building a BSP from scratch, so I had to make a
> few more fixes for variables that are expanded before the code signing
> provider is installed.
> 
> > > >  )
> > > >  endef
> > > >  
> > > > @@ -40,5 +43,8 @@ $(strip \
> > > >  		$(call ptx/cs-consumer-env, $(1))\
> > > >  			cs_get_ca '$(strip $(2))'\
> > > >  	)\
> > > > +	$(if $(filter-out 0,$(.SHELLSTATUS)),\
> > > > +		$(call ptx/error, cs-get-ca: whitelist check failed – see errors above)\
> > > > +	)\
> > > 
> > > same here.
> 
>  - Roland
> 
> 
> -- 
> Roland Hieber, Pengutronix e.K.          | r.hieber@pengutronix.de     |
> Steuerwalder Str. 21                     | https://www.pengutronix.de/ |
> 31137 Hildesheim, Germany                | Phone: +49-5121-206917-0    |
> Amtsgericht Hildesheim, HRA 2686         | Fax:   +49-5121-206917-5555 |
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de