Kbuild fixes for v6.2 (4th)

- Fix two bugs (for building and for signing) when CONFIG_MODULE_SIG_KEY
    contains PKCS#11 URI.
 -----BEGIN PGP SIGNATURE-----
 
 iQJJBAABCgAzFiEEbmPs18K1szRHjPqEPYsBB53g2wYFAmPemkwVHG1hc2FoaXJv
 eUBrZXJuZWwub3JnAAoJED2LAQed4NsGIBEP/3qK6z8tQDs3lN46vRVHJyZ5zPeD
 jqxjVnXO1JThBOMM3YAmH2vfr44Uh+XDAuwS0hnSYgk3EuKo1kjVIXxMLT3M3Szs
 uYI0j6lorIIZ6k+p8k/wpQgzTbgz6/SgIfRrQhMsN6mwjA9eN1O5X385oHQ9BQm9
 pQAMRkEMSwM4F4qOttBoWhkWjoFKcpy++KBNJmpCGIPq2ljNKqWvbzOkZ1WEDAKv
 n6jvy/b7J4RavjHKf1X8Kb72unTJpe+FOwjUujnSo+QydT5el3zjBnz39PWiSt+3
 T7GnpfLlev2zWxPxurWJhLj6hxCs/JnVgPTcBEHo04+jmKLhsZ3SaunbTh0izqcE
 0IHMFhmKnTHN+PafZ6wM5TbIlG1IgMeTRqflRYC1IxodBHmQ9v59m4wmlTm9BZJV
 mtQWc5nFsGKaq8Na1nmNJB5IIeH45BJ9KjkOrXDVzdMy0i/9haxeMB0/qJQlgvjD
 xUwNhz2YSHHvHJ8Lb6+eb6cpQlJYQZ7tWFY4SSyRATBadkVl0ewUV53pgSOokbCD
 Ck/x8+j5QVOZnOj7z+7a/N1RDgJtZYuk1h7SYdQTVEBXjZPb4/dFkTUE/FHIm8LA
 AmAPa/2XK0da7bhKaOScqz6m9roEuTOPNiGqfWf39tcdXteavR+CfCNTmf8UQEA2
 VMAB+pu3kMnfOFFD
 =EZQr
 -----END PGP SIGNATURE-----

Merge tag 'kbuild-fixes-v6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

Pull Kbuild fixes from Masahiro Yamada:

 - Fix two bugs (for building and for signing) when MODULE_SIG_KEY
   contains a PKCS#11 URI

* tag 'kbuild-fixes-v6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
  kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a PKCS#11 URI
  certs: Fix build error when PKCS#11 URI contains semicolon

certs/Makefile

@@ -23,8 +23,8 @@ $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
 targets += blacklist_hash_list
 
 quiet_cmd_extract_certs  = CERT    $@
-      cmd_extract_certs  = $(obj)/extract-cert $(extract-cert-in) $@
-extract-cert-in = $(or $(filter-out $(obj)/extract-cert, $(real-prereqs)),"")
+      cmd_extract_certs  = $(obj)/extract-cert "$(extract-cert-in)" $@
+extract-cert-in = $(filter-out $(obj)/extract-cert, $(real-prereqs))
 
 $(obj)/system_certificates.o: $(obj)/x509_certificate_list
 

scripts/Makefile.modinst

@@ -66,9 +66,13 @@ endif
 # Don't stop modules_install even if we can't sign external modules.
 #
 ifeq ($(CONFIG_MODULE_SIG_ALL),y)
+ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),)
 sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY)
+else
+sig-key := $(CONFIG_MODULE_SIG_KEY)
+endif
 quiet_cmd_sign = SIGN    $@
-      cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(sig-key) certs/signing_key.x509 $@ \
+      cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \
                  $(if $(KBUILD_EXTMOD),|| true)
 else
 quiet_cmd_sign :=