| Message ID | 20260916192838.46653-1-f_l_k@t-online.de |
|---|---|
| State | New |
| Headers | show |
| Series | kernel-module-split: don't re-sign compressed kernel modules | expand |
Thank you for your submission. Patchtest identified one or more issues with the patch. Please see the log below for more information: --- Testing patch /home/patchtest/share/mboxes/kernel-module-split-don-t-re-sign-compressed-kernel-modules.patch FAIL: test Signed-off-by presence: Mbox is missing Signed-off-by. Add it manually or with "git commit --amend -s" (test_mbox.TestMbox.test_signed_off_by_presence) PASS: test auh changelog truncation notice (test_mbox.TestMbox.test_auh_changelog_truncation_notice) PASS: test author valid (test_mbox.TestMbox.test_author_valid) PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence) PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags) PASS: test max line length (test_metadata.TestMetadata.test_max_line_length) PASS: test mbox format (test_mbox.TestMbox.test_mbox_format) PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade) PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format) PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length) PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list) SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint) SKIP: pretest src uri left files: No modified recipes, skipping pretest (test_metadata.TestMetadata.pretest_src_uri_left_files) SKIP: test CVE check ignore: No modified recipes or older target branch, skipping test (test_metadata.TestMetadata.test_cve_check_ignore) SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format) SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence) SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format) SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format) SKIP: test lic files chksum modified not mentioned: No modified recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned) SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence) SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence) SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint) SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head) SKIP: test src uri left files: No modified recipes, skipping test (test_metadata.TestMetadata.test_src_uri_left_files) SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence) --- Please address the issues identified and submit a new revision of the patch, or alternatively, reply to this email with an explanation of why the patch should be accepted. If you believe these results are due to an error in patchtest, please submit a bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category under 'Yocto Project Subprojects'). For more information on specific failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank you!
diff --git a/meta/classes-recipe/kernel-module-split.bbclass b/meta/classes-recipe/kernel-module-split.bbclass index 99c2d12962..9a7f04f37b 100644 --- a/meta/classes-recipe/kernel-module-split.bbclass +++ b/meta/classes-recipe/kernel-module-split.bbclass @@ -53,8 +53,15 @@ post_strip_kernel_modules_signing(){ is_modules="$(${STAGING_KERNEL_DIR}/scripts/config --file ${KBUILD_OUTPUT}/.config --state MODULES)" is_module_sig="$(${STAGING_KERNEL_DIR}/scripts/config --file ${KBUILD_OUTPUT}/.config --state MODULE_SIG)" is_module_sig_all="$(${STAGING_KERNEL_DIR}/scripts/config --file ${KBUILD_OUTPUT}/.config --state MODULE_SIG_ALL)" - - if [ "$is_modules" = "y" ] && [ "$is_module_sig" = "y" ] && [ "$is_module_sig_all" = "y" ]; then + is_module_compress_all="$(${STAGING_KERNEL_DIR}/scripts/config --file ${KBUILD_OUTPUT}/.config --state MODULE_COMPRESS_ALL)" + + # Compressed modules are not ELF files, so package stripping leaves them + # untouched and the signature made during modules_install is still valid. + # Re-signing them is not only unnecessary but fails: with + # CONFIG_MODULE_COMPRESS_ALL the install targets carry the compression + # suffix, and the uncompressed module their rule depends on does not + # exist below ${PKGD}. + if [ "$is_modules" = "y" ] && [ "$is_module_sig" = "y" ] && [ "$is_module_sig_all" = "y" ] && [ "$is_module_compress_all" != "y" ]; then # Sign modules under ${PKGD}, with M= if out-of-tree module. # Out-of-tree module Makefiles invoke the kernel Makefile by appending M= (the module directory) to MAKEFLAGS. # However, they usually do not provide a modules_sign target. Therefore, the kernel modules_sign target has to
With CONFIG_MODULE_COMPRESS_ALL the kernel installs modules with a compression suffix, and scripts/Makefile.modinst derives the compressed file from the signed uncompressed one, which is removed afterwards. The modules_sign target then has nothing to sign below ${PKGD} and do_package fails in sign-file with an openssl "no such file" error. Re-signing is not needed there either: compressed modules are not ELF files, so package stripping leaves them alone and the signature made during modules_install is still valid. Found on a raspberrypi4-64 kernel, which enables both MODULE_SIG_ALL and MODULE_COMPRESS_XZ. Tested by building linux-raspberrypi through do_package, which now packages 1861 signed .ko.xz modules. AI-Generated: Uses Claude Code --- meta/classes-recipe/kernel-module-split.bbclass | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)