linux-kernel - [Plucky/Unstable PATCH 1/2] UBUNTU: [Packaging] Avoid Arch-Specific Certificate Creation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241120021205.1590999-2-masahiro.yamada@canonical.com>
Date: Wed, 20 Nov 2024 11:11:01 +0900
From: Masahiro Yamada <masahiro.yamada@...onical.com>
To: kernel-team@...ts.ubuntu.com
Cc: linux-kernel@...r.kernel.org
Subject: [Plucky/Unstable PATCH 1/2] UBUNTU: [Packaging] Avoid Arch-Specific Certificate Creation

Currently, the debian/canonical-(revoked-)certs.pem files are generated
by the clean target and included in the source package.

These files are created by concatenating *-all.pem and *-$(arch).pem
files.

When creating a source package, $(arch) expands to the architecture of
the build machine.

Although it is unclear whether arch-specific certificates have ever
been used, if they were, canonical-(revoked-)certs.pem would become
architecture-specific, resulting in an architecture-dependent source
package.

The source package should be consistent, regardless of the architecture
of the build machine.

This commit changes the build rules to concatenate all *.pem files,
ensuring the output is independent of the build machine architecture.

Signed-off-by: Masahiro Yamada <masahiro.yamada@...onical.com>
---

 debian/rules | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/debian/rules b/debian/rules
index c6facd5717c6..600e7bab2150 100755
--- a/debian/rules
+++ b/debian/rules
@@ -213,7 +213,7 @@ $(DEBIAN)/control.stub: 				\
 debian/control: $(DEBIAN)/control.stub
 	cp $(DEBIAN)/control.stub debian/control

-debian/canonical-certs.pem: $(wildcard debian/certs/*-all.pem) $(wildcard debian/certs/*-$(arch).pem) $(wildcard $(DEBIAN)/certs/*-all.pem) $(wildcard $(DEBIAN)/certs/*-$(arch).pem)
+debian/canonical-certs.pem: $(wildcard debian/certs/*.pem $(DEBIAN)/certs/*.pem)
 	for cert in $(sort $(notdir $^));					\
 	do									\
 		for dir in $(DEBIAN) debian;					\
@@ -225,7 +225,7 @@ debian/canonical-certs.pem: $(wildcard debian/certs/*-all.pem) $(wildcard debian
 		done;								\
 	done >"$@"

-debian/canonical-revoked-certs.pem: $(wildcard debian/revoked-certs/*-all.pem) $(wildcard debian/revoked-certs/*-$(arch).pem) $(wildcard $(DEBIAN)/revoked-certs/*-all.pem) $(wildcard $(DEBIAN)/revoked-certs/*-$(arch).pem)
+debian/canonical-revoked-certs.pem: $(wildcard debian/revoked-certs/*.pem $(DEBIAN)/revoked-certs/*.pem)
 	for cert in $(sort $(notdir $^));					\
 	do									\
 		for dir in $(DEBIAN) debian;					\
-- 
2.43.0