On 29.04.20 15:00, yue...@gmail.com wrote:
> In tree kernel modules gets signed with the CONFIG_MODULE_SIG_ALL kernel
> option, but extra (resp. external) modules not. If you (resp. isar) not
> provide an (external) signing key, the kernel build autogenerates a
> private/public key pair. It would be nice if the isar build system
> provide some support for signing kernel modules.
>
> I see currently 2 use cases:
> 1) let the kernel build to autogenerate private/public key for kernel
> module signing and kernel-module reuse the key for signing (evt. isar
> deletes the private key after image generation)
> 2) provide an (external) private and public key for kernel module
> signing and will be used in kernel and kernel-module recipes
>

We likely want to go for path 2 because the first option prevents
reproducibility. And that means we need to define a channel how to
provide those keys both to the kernel build as well as the external
module builds.

Did you happen to observe if kernel-headers will include at least the
script/sign-file host tool when CONFIG_MODULE_SIG_FORMAT is enabled?
That - together with the keys - would be needed in order to sign
external modules already during their build.

Jan

--
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux