On Mon, Jun 28, 2021 at 12:21 PM Stefan Berger [off-list ref] wrote:

Correct, and the code (certs/Makefile) is surrounded by the check for
this particular file here, so it won't touch anything else:

Ahh, I missed that part.

Can we just make it really really obvious, and not use
CONFIG_MODULE_SIG_KEY at all, then?

IOW, make these literally be about "certs/signing_key.pem" and nothing
else, so that when people grep for this, or look at the Makefile, they
don't fall into that trap I fell into?

That also would make it obvious that there are no pathname quoting issues etc.

             Linus