From ef126bbe89ea630c474559493c35e0642eb42157 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Tue, 28 Nov 2023 10:11:56 +0100
Subject: [PATCH 1/3] man/ukify: link to competing tools

Right now each of the three invocations yields a part of the picture.
Let's make it easier for users to discover the right tools.
---
 man/ukify.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/man/ukify.xml b/man/ukify.xml
index 9b7e20997a..1865c1bfed 100644
--- a/man/ukify.xml
+++ b/man/ukify.xml
@@ -140,6 +140,12 @@
 
       <para>Also see the description of <option>-j</option>/<option>--json=</option> and
       <option>--section=</option>.</para>
+
+      <para>Other tools that may be useful for inspect UKIs:
+      <citerefentry project='man-pages'><refentrytitle>llvm-objdump</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <option>-p</option> and <command>pe-inspect</command>.
+      <!-- TODO: add link to pe-inspect man page when it gets one -->
+      </para>
     </refsect2>
   </refsect1>
 

From 2060509d1245de797f89292b9513364c3e4cbbb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Tue, 28 Nov 2023 16:52:21 +0100
Subject: [PATCH 2/3] kernel-install/60-ukify: use exec() instead of runpy

As suggested by Daniele Nicolodi.

Also drop left-over debug line.
---
 src/kernel-install/60-ukify.install.in | 34 ++++++++++++--------------
 1 file changed, 15 insertions(+), 19 deletions(-)

diff --git a/src/kernel-install/60-ukify.install.in b/src/kernel-install/60-ukify.install.in
index be1e21b4e7..e09880fc0e 100755
--- a/src/kernel-install/60-ukify.install.in
+++ b/src/kernel-install/60-ukify.install.in
@@ -21,8 +21,8 @@
 
 import argparse
 import os
-import runpy
 import shlex
+import types
 from shutil import which
 from pathlib import Path
 from typing import Optional
@@ -210,22 +210,20 @@ def initrd_list(opts) -> list[Path]:
     return [*microcode, *opts.initrd, *initrd]
 
 
-def call_ukify(opts):
-    # Punish me harder.
-    # We want this:
-    #   ukify = importlib.machinery.SourceFileLoader('ukify', UKIFY).load_module()
-    # but it throws a DeprecationWarning.
-    # https://stackoverflow.com/questions/67631/how-can-i-import-a-module-dynamically-given-the-full-path
-    # https://github.com/python/cpython/issues/65635
-    # offer "explanations", but to actually load a python file without a .py extension,
-    # the "solution" is 4+ incomprehensible lines.
-    # The solution with runpy gives a dictionary, which isn't great, but will do.
-    ukify = runpy.run_path(UKIFY, run_name='ukify')
+def load_module(name: str, path: str) -> types.ModuleType:
+    module = types.ModuleType(name)
+    text = open(path).read()
+    exec(compile(text, path, 'exec'), module.__dict__)
+    return module
+
+
+def call_ukify(opts) -> None:
+    ukify = load_module('ukify', UKIFY)
 
     # Create "empty" namespace. We want to override just a few settings, so it
     # doesn't make sense to configure everything. We pretend to parse an empty
     # argument set to prepopulate the namespace with the defaults.
-    opts2 = ukify['create_parser']().parse_args(['build'])
+    opts2 = ukify.create_parser().parse_args(['build'])
 
     opts2.config = uki_conf_location()
     opts2.uname = opts.kernel_version
@@ -241,12 +239,10 @@ def call_ukify(opts):
     if BOOT_STUB:
         opts2.stub = BOOT_STUB
 
-    # opts2.summary = True
-
-    ukify['apply_config'](opts2)
-    ukify['finalize_options'](opts2)
-    ukify['check_inputs'](opts2)
-    ukify['make_uki'](opts2)
+    ukify.apply_config(opts2)
+    ukify.finalize_options(opts2)
+    ukify.check_inputs(opts2)
+    ukify.make_uki(opts2)
 
     log(f'{opts2.output} has been created')
 

From 34c2fc8505a7afd929d9dd82aed2c664d878d983 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Tue, 28 Nov 2023 16:55:45 +0100
Subject: [PATCH 3/3] ukify: simplify import

---
 src/ukify/ukify.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ukify/ukify.py b/src/ukify/ukify.py
index 08f505a271..0e4b2483a6 100755
--- a/src/ukify/ukify.py
+++ b/src/ukify/ukify.py
@@ -773,7 +773,7 @@ def make_uki(opts):
         if opts.pcr_public_keys and len(opts.pcr_public_keys) == 1:
             pcrpkey = opts.pcr_public_keys[0]
         elif opts.pcr_private_keys and len(opts.pcr_private_keys) == 1:
-            import cryptography.hazmat.primitives.serialization as serialization
+            from cryptography.hazmat.primitives import serialization
             privkey = serialization.load_pem_private_key(opts.pcr_private_keys[0].read_bytes(), password=None)
             pcrpkey = privkey.public_key().public_bytes(
                 encoding=serialization.Encoding.PEM,