Hi Lucas, Is there any chance for accepting this patch? Or could you tell me how it can be reworked so that modinfo would support PKCS#7 (and LibreSSL)? -- Stefan On 15/02/2019 15:30, Stefan Strogin wrote: > On 15/02/2019 10:04, Lucas De Marchi wrote: >> >> ooh, this ifdef is messy. Why do we want both libressl and openssl? What >> distro is requiring that? > > Well, in the kernel in scripts/sign-file.c the same ifdefs are used. > > Every distro that tries to support LibreSSL requires that. I know at least > Gentoo [1], Alpine and Void. > >> if in the end we end up with ifdefs for N different libs I'd rather just >> add the implementation in kmod itself or convince kernel guys to just >> fill out the struct they are supposed to fill. > > If you don't like ifdefs at all I would say that CMS is not needed. CMS and > PKCS#7 formats are very similar. CMS is newer but is as much as possible > backward compatible [2], but PKCS#7 is better supported. PKCS#7 has all the same > fields that are used when a kernel module is signed using CMS (and otherwise). > For example I can sign a module using OpenSSL-1.1.1 and CMS (even with hashes > other than sha1) and read its signing information with modinfo and PKCS#7 on a > system with LibreSSL, and otherwise. > > So we can just replace CMS with PKCS#7 in fill_pkcs7(). > > [1] https://bugs.gentoo.org/677960 > [2] https://tools.ietf.org/html/rfc5652#section-1.1 > > -- > Stefan >
