RFR 8193255: Root Certificates should be stored in text format and assembled at build time

Erik Joelsson erik.joelsson at oracle.com
Thu May 30 17:34:32 UTC 2019


On 2019-05-30 08:32, Weijun Wang wrote:
>
>> On May 30, 2019, at 10:01 PM, Erik Joelsson <erik.joelsson at oracle.com> wrote:
>>
>> In my experience, using directories for dependencies in make does not work well. Since all the files in make/data/cacerts are in a flat structure, I would recommend expressing the prerequisites as:
>>
>> $(wildcard $(GENDATA_CACERTS_SRC)/*)
>>
>> This will not cover the case where a file is removed, but that case is rarely handled well in make based build systems.
> But in my experiment, using the directory name does detect the file removal.

It believe that worked well on your machine, but directory timestamp 
updates are file system dependent. I'm not sure we can count on all 
filesystems to accurately reflect time stamps based on file 
modification. It's also possible that an OS would touch directory 
timestamps for other reasons, which should not affect the build. I 
haven't tried having source directories as prerequisites before, so I 
simply don't know how reliable it is. My experience is rather with 
directories as targets, which certainly doesn't work. If you verified 
that it worked as expected on all supported OSes, I would be less worried.

> Or, can I list *both* the files and the directory to get maximum awareness?

The directory modification time will usually not change when a file in 
it is modified, only when adding or removing files (and possibly some 
other operations), so adding the files is certainly a must. If you go 
with both, then I would just be worried about potential false positives.

/Erik




More information about the security-dev mailing list