On Mon, 2022-06-27 at 15:49 -0400, Mike Gilbert wrote: > On Mon, Jun 27, 2022 at 3:42 PM Georgy Yakovlev > <[email protected]> wrote: > > > > On Mon, 2022-06-27 at 14:56 -0400, Mike Gilbert wrote: > > > On Mon, Jun 27, 2022 at 2:35 PM Kenton Groombridge > > > <[email protected]> wrote: > > > > > so looks like we need to combine both methods and do the > > > > > following: > > > > > - if signing requested without compression - sign in > > > > > pkg_preinst. > > > > > - if signing requested with compression - sign in > > > > > src_install > > > > > > > > > > > > > Why can't we do both in pkg_preinst? I am thinking it would be > > > > best > > > > if > > > > we drop the current compression implementation and rework your > > > > old > > > > code > > > > to handle both compression and signing since the signing code > > > > is > > > > more or > > > > less already complete. > > > > > > Signing modules in pkg_preinst seems like a bad idea to me. That > > > means > > > you need to copy your private keys around to every host where the > > > package might be installed. > > > > > > If you sign in src_compile or src_install, you only need private > > > keys > > > on the system building your binpkg. > > > > > > > unfortunately portage will unconditionally strip .ko objects, > > rendering > > modules unloadable by stripping signature, unless we do dostrip -x > > (requires EAPI7+, which should not be a problem nowadays, but was a > > problem back in 2018), which can be quite unfortunate on debug > > enabled > > kernels. > > Sounds like something to fix/change in Portage. It could probably be > updated to not strip the signature. However, I would guess the > signature needs to be updated after the binary is modified in any > case. > > Or as a workaround you could disable automatic striping via dostrip - > x > and run the proper commands to strip the modules in src_install as > well. > I think even strip itself does not have proper options not to break module. Several years back it was the case, basically one has to strip first, sign second, otherwise module will be unloadable.
"Signed modules are BRITTLE as the signature is outside of the defined ELF container. Thus they MAY NOT be stripped once the signature is computed and attached. Note the entire module is the signed payload, including any and all debug information present at the time of signing." https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html#signed-modules-and-stripping
