Hello:

This series was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi [off-list ref]:

On Wed,  8 Jul 2026 09:53:35 +0200 you wrote:

The BPF signing scheme signs a light skeleton's loader program and lets
the loader vouch for everything else: bpftool bakes the SHA256 of the
metadata map into the loader's instructions, signs the instructions, and
the loader compares the (frozen, exclusive) map against that hash from
within BPF once it runs. The construction is sound as a trusted hash
chain, but the kernel itself never attests the metadata, and that split
has been the recurring objection from the LSM / integrity side since the
scheme was proposed.

[...]

Here is the summary with links:
  - [bpf-next,v6,1/8] bpf: Resolve and cache fd_array objects at load time
    https://git.kernel.org/bpf/bpf-next/c/d5a85392392c
  - [bpf-next,v6,2/8] bpf: Verify signed loader metadata at load time
    https://git.kernel.org/bpf/bpf-next/c/b707068e0ed9
  - [bpf-next,v6,3/8] libbpf: Drop in-loader metadata check for load-time verification
    https://git.kernel.org/bpf/bpf-next/c/a2d784869a0f
  - [bpf-next,v6,4/8] bpftool: Check EVP_Digest when computing excl_prog_hash
    https://git.kernel.org/bpf/bpf-next/c/576bcaa1f5c2
  - [bpf-next,v6,5/8] bpftool: Cover loader metadata with the program signature
    https://git.kernel.org/bpf/bpf-next/c/92c7717981bb
  - [bpf-next,v6,6/8] selftests/bpf: Adjust bpf_map layout in verifier_map_ptr
    https://git.kernel.org/bpf/bpf-next/c/77e5f3c91453
  - [bpf-next,v6,7/8] selftests/bpf: Verify load-time signed loader metadata
    https://git.kernel.org/bpf/bpf-next/c/99b321dde704
  - [bpf-next,v6,8/8] Documentation/bpf: Add BPF signing and enforcement doc
    https://git.kernel.org/bpf/bpf-next/c/84c42f515f18

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html