certs: use if_changed to re-generate the key when the key type is changed

[uclinux-h8/linux.git] / certs / Makefile

diff --git a/certs/Makefile b/certs/Makefile
index 2794337..a702b70 100644 (file)
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -50,76 +50,32 @@ ifdef SIGN_KEY
 # fail and that the kernel may be used afterwards.
 #
 ###############################################################################
-ifndef CONFIG_MODULE_SIG_HASH
-$(error Could not determine digest type to use from kernel config)
-endif
-
-redirect_openssl       = 2>&1
-quiet_redirect_openssl = 2>&1
-silent_redirect_openssl = 2>/dev/null
-openssl_available       = $(shell openssl help 2>/dev/null && echo yes)
 
 # We do it this way rather than having a boolean option for enabling an
 # external private key, because 'make randconfig' might enable such a
 # boolean option and we unfortunately can't make it depend on !RANDCONFIG.
 ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
 
-ifeq ($(openssl_available),yes)
-X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null)
-endif
-
-# Support user changing key type
-ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA
-keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1
-ifeq ($(openssl_available),yes)
-$(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))
-endif
-endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA
+keytype-$(CONFIG_MODULE_SIG_KEY_TYPE_ECDSA) := -newkey ec -pkeyopt ec_paramgen_curve:secp384r1
 
-ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA
-ifeq ($(openssl_available),yes)
-$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))
-endif
-endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA
-
-$(obj)/signing_key.pem: $(obj)/x509.genkey
-       @$(kecho) "###"
-       @$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
-       @$(kecho) "###"
-       @$(kecho) "### If this takes a long time, you might wish to run rngd in the"
-       @$(kecho) "### background to keep the supply of entropy topped up.  It"
-       @$(kecho) "### needs to be run as root, and uses a hardware random"
-       @$(kecho) "### number generator if one is available."
-       @$(kecho) "###"
-       $(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
+quiet_cmd_gen_key = GENKEY  $@
+      cmd_gen_key = openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
                -batch -x509 -config $(obj)/x509.genkey \
                -outform PEM -out $(obj)/signing_key.pem \
-               -keyout $(obj)/signing_key.pem \
-               $(keytype_openssl) \
-               $($(quiet)redirect_openssl)
-       @$(kecho) "###"
-       @$(kecho) "### Key pair generated."
-       @$(kecho) "###"
+               -keyout $(obj)/signing_key.pem $(keytype-y) 2>&1
+
+$(obj)/signing_key.pem: $(obj)/x509.genkey FORCE
+       $(call if_changed,gen_key)
+
+targets += signing_key.pem
 
+quiet_cmd_copy_x509_config = COPY    $@
+      cmd_copy_x509_config = cat $(srctree)/$(src)/default_x509.genkey > $@
+
+# You can provide your own config file. If not present, copy the default one.
 $(obj)/x509.genkey:
-       @$(kecho) Generating X.509 key generation config
-       @echo  >$@ "[ req ]"
-       @echo >>$@ "default_bits = 4096"
-       @echo >>$@ "distinguished_name = req_distinguished_name"
-       @echo >>$@ "prompt = no"
-       @echo >>$@ "string_mask = utf8only"
-       @echo >>$@ "x509_extensions = myexts"
-       @echo >>$@
-       @echo >>$@ "[ req_distinguished_name ]"
-       @echo >>$@ "#O = Unspecified company"
-       @echo >>$@ "CN = Build time autogenerated kernel key"
-       @echo >>$@ "#emailAddress = unspecified.user@unspecified.company"
-       @echo >>$@
-       @echo >>$@ "[ myexts ]"
-       @echo >>$@ "basicConstraints=critical,CA:FALSE"
-       @echo >>$@ "keyUsage=digitalSignature"
-       @echo >>$@ "subjectKeyIdentifier=hash"
-       @echo >>$@ "authorityKeyIdentifier=keyid"
+       $(call cmd,copy_x509_config)
+
 endif # CONFIG_MODULE_SIG_KEY
 
 $(eval $(call config_filename,MODULE_SIG_KEY))