[PATCH bpf-next v7 4/9] selftests/bpf: generate the signing key and certificate once

$(VERIFICATION_CERT) and $(PRIVATE_KEY) come from a single genkey
invocation, but a rule with two normal targets runs its recipe once
per stale target. Today only $(VERIFICATION_CERT) is ever a
prerequisite (of $(VERIFY_SIG_HDR)), so the recipe runs once; the
runner patch later in this series lists both files as prerequisites
of the same target, at which point both runs would execute, under -j
concurrently, and the openssl invocations would race on the same
output files.

Rewrite it as a pattern rule, the same workaround the test_kmods
rule already uses, with the stem narrowed to the fixed name: genkey
hardcodes signing_key.pem / signing_key.der, and a wider pattern
would claim every .pem/.der under $(BUILD_DIR) and "succeed" without
producing the requested file.

Signed-off-by: Mykola Lysenko <[email protected]>
Acked-by: Eduard Zingerman <[email protected]>
---
 tools/testing/selftests/bpf/Makefile | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index e4c8efd1e6f1..7b80a1b1ef76 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -787,7 +787,12 @@ VERIFY_SIG_HDR := verification_cert.h
 VERIFICATION_CERT   := $(BUILD_DIR)/signing_key.der
 PRIVATE_KEY := $(BUILD_DIR)/signing_key.pem
 
-$(VERIFICATION_CERT) $(PRIVATE_KEY): $(VERIFY_SIG_SETUP)
+# One genkey run produces both files. A plain two-target rule is not
+# grouped - if both files are stale make would run genkey twice, under
+# -j concurrently, and the openssl invocations race; the pattern form
+# is implicitly grouped even with make < 4.3. The stem only stands in
+# for 'signing' so that no other .pem/.der under $(BUILD_DIR) matches.
+$(BUILD_DIR)/%_key.pem $(BUILD_DIR)/%_key.der: $(VERIFY_SIG_SETUP)
 	$(Q)mkdir -p $(BUILD_DIR)
 	$(Q)$(VERIFY_SIG_SETUP) genkey $(BUILD_DIR)
 
-- 
2.43.0