From: pbrobinson on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1284 NOTE: Truncated patchset due to missing public @redhat.com email address on your GitLab profile at https://gitlab.com/-/profile. Once that is fixed, close and reopen the merge request to retrigger sending the emails.
We want the TRUSTED_KEYS support built in everywhere, it's currently just built in for x86/power on ark. We need it built in for aarch64 as well, and it should be the same on Fedora.
Signed-off-by: Peter Robinson pbrobinson@redhat.com
--- redhat/configs/ark/generic/powerpc/CONFIG_TRUSTED_KEYS | 1 - redhat/configs/ark/generic/x86/x86_64/CONFIG_TRUSTED_KEYS | 1 - redhat/configs/ark/generic/CONFIG_TEE => redhat/configs/common/generic/CONFIG_TEE | 0 redhat/configs/common/generic/CONFIG_TRUSTED_KEYS | 2 +- redhat/configs/fedora/generic/arm/CONFIG_TEE | 1 - redhat/configs/fedora/generic/CONFIG_TEE | 1 - 6 files changed, 1 insertions(+), 5 deletions(-)
From: Ondrej Mosnáček on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1284#note_6590140...
I don't have any objection to the change, but could you explain in the commit message why it is needed/wanted? It's not really obvious to me, and will be even less obvious to someone looking at it X years later :)
From: pbrobinson on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1284#note_6605761...
We need it for IMA and other related pieces for RHEL for Edge for security. Also I wonder why you wouldn't want something like this consistent across all architectures.
From: Ondrej Mosnáček on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1284#note_6606202...
I do want configs to be consistent wherever possible, I'd just like it to be documented why =y was chosen over =m. I trust that there is a good reason, but it should be spelled out at least briefly in the commit message. I'm ready with my finger on the Approve button once it is.
From: pbrobinson on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1284#note_6606383...
RHEL has them built in for x86/POWER so it was partially consistency there, but also as IMA is needed early in the boot process.
From: Ondrej Mosnáček on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1284#note_6630801...
Ok, you're almost there, but I'd like to see this information captured *in the commit message*. Years later, someone might wonder why `=y` was chosen for `CONFIG_TRUSTED_KEYS`. They should be able to just do `git log redhat/configs/common/generic/CONFIG_TRUSTED_KEYS` and see in the commit message the reasoning (e.g. something like "Set TRUSTED_KEYS to =y in both Fedora and RHEL, as otherwise <thing> breaks because IMA needs to use trusted keys early in the boot process."). This is what every developer should strive for in every commit message - explaining the "why" behind the change is crucial.
From: Bruno Meneguele on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1284#note_7135542...
@pbrobinson can you rebase this MR? It's conflicting with the current main branch code and won't be able to be merged. Also, please add @omos suggestion to the commit log so we have it clear for future reference.
kernel@lists.fedoraproject.org
-
Bruno Meneguele (via Email Bridge) -
Ondrej Mosnáček (via Email Bridge)
-
pbrobinson (via Email Bridge)