makefiles/suit: place keys in $XDG_DATA_HOME #18157
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
Area: build system
benpicco
added
Process: API change
maribu
reviewed
Jun 2, 2022
Placing the SUIT key in the RIOT repository folder is dangerous as a repo checkout is by most people considered a volatile location. Since all important files are stored in git, deleting the entire folder or it's contents is not an uncommon cleanup operation. If the user is at that point unaware that SUIT key material is stored in that folder, that key will then be lost. Another workflow may involve multiple checkouts of the RIOT repository to multiple folders to work on several features at the same time, or for easy cross-referencing or splitting of off features from an integration into a feature branch. In that case each checkout would use it's own incompatible SUIT key. To avoid all these pitfalls, place the SUIT keys outside the RIOT repository in the $XDG_DATA_HOME directory.
|
Can you post some test output? |
|
Of your suggested test procedure :) |
|
This might fail on CI, as parallel builds share some random |
|
So, if I'd want to get back the original behavior, I'd have to inject a local makefile, right? |
You can still set the |
|
ok
But, |
make suit/publish |
benpicco
added
the
CI: ready for build
maribu
approved these changes
Jun 28, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Contribution description
Placing the SUIT key in the RIOT repository folder is dangerous as a repo checkout is by most people considered a volatile location.
Since all important files are stored in git, deleting the entire folder or it's contents is not an uncommon cleanup operation.
If the user is at that point unaware that SUIT key material is stored in that folder, that key will then be lost.
Another workflow may involve multiple checkouts of the RIOT repository to multiple folders to work on several features at the same time, or for easy cross-referencing or splitting of off features from an integration into a feature branch.
In that case each checkout would use it's own incompatible SUIT key.
To avoid all these pitfalls, place the SUIT keys outside the RIOT repository in the
$XDG_DATA_HOMEdirectory.Testing procedure
should still work (with a new key being generated in
~/.local/share/RIOT/keys).Issues/PRs references