sbupdate for signing kernel modules too? about sbupdate HOT 2 CLOSED

Hi,

From the documentation it follows that modules should be signed at install time, and that the public key should be embedded in the kernel during the build time. So, this can only work if you are building the kernel yourself and have enabled the necessary configuration options. In such case, configuration and signing should be done in the PKGBUILD.

For the core linux and linux-lts Arch Linux kernels the kernel maintainers would need to configure and enable module signing using an Arch Linux key. Note that the Secure Boot keys and the module signing key need not be the same, so this would work. If you are interested in this, you could open a feature request at https://bugs.archlinux.org/.

from sbupdate.

@andreyv Yeah, it would also unfortunately break dkms if they did enable it. I could probably hack together a pkgbuild that would build a kernel that pulls your public key from an sbupdate cert and then signs with the key, but the hard part would be figuring out how to hook dkms to to sign on kernel upgrades.

The problem with dkms for official Kernel package support is that if you could sign your own dkms modules, you would have to have Arch's private keys to sign them, so it's incompatible.

I was wondering, I guess, if it were possible to use sbupdate to apply a binary patch rather than a source patch to patch in the pubkey, but that would probably be pretty difficult.

from sbupdate.