Hi Antonin,
I took your suggestion into account. A v2 patch may look like this:
if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
# If the module will be auto-signed, perform stripping before
signing.
if [ "$(./source/scripts/config --file ./.config --state
MODULE_SIG)" = y ] &&
[ "$(./source/scripts/config --file ./.config --state
MODULE_SIG_ALL)" = y ]; then
export INSTALL_MOD_STRIP="--strip-debug
--remove-section=.comment --remove-section=.note --preserve-dates"
fi
oe_runmake DEPMOD=echo
MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}
INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware modules_install
fi
However, I think grepping the .config file is more reliable, since its
location inside ${WORKDIR} is more stable than the location of the config
script.
I stay open to any further suggestions.
BR,
Anis
On Wed, Aug 12, 2026 at 3:50 PM Antonin Godard <[email protected]>
wrote:
> Hi,
>
> On Wed Aug 12, 2026 at 3:06 PM CEST, Anis Bougrine via
> lists.openembedded.org wrote:
> > Currently, signed kernel modules skip the stripping process in order
> > to preserve the file contents after signing. See commit:
> > 4c47e5f171fa2603355e2f9183065ce8137a18c7
> >
> > However, the kernel install Makefile supports stripping modules before
> > signing them. This allows signed modules to be stripped while preserving
> > a valid signature.
> >
> > Make non-signed kernel modules follow the standard Yocto stripping flow,
> > while signed kernel modules use the kernel Makefile stripping flow.
> >
> > Fixes [YOCTO #12927]
> >
> > Reported-by: [email protected]
> > Signed-off-by: Anis Bougrine <[email protected]>
> > ---
> > meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++-
> > 1 file changed, 15 insertions(+), 1 deletion(-)
> >
> > diff --git a/meta/classes-recipe/kernel.bbclass
> b/meta/classes-recipe/kernel.bbclass
> > index a82bdf7ecb..0d8d370e9d 100644
> > --- a/meta/classes-recipe/kernel.bbclass
> > +++ b/meta/classes-recipe/kernel.bbclass
> > @@ -453,7 +453,21 @@ kernel_do_install() {
> > #
> > unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
> > if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
> > - oe_runmake DEPMOD=echo
> MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}
> INSTALL_FW_PATH=${D}${firmwaredir} modules_install
> > + # If the module will be auto-signed, perform stripping
> before signing.
> > + if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q
> '^CONFIG_MODULE_SIG_ALL=y$' .config; then
>
> Suggestion: you can use the kernel's scripts/config utility to get the
> option
> values:
>
> $ ./scripts/config --file ./.config --state MODULE_SIG
> y
>
> So that you really see the option value as the kernel sees it.
>
> Antonin
>
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#243295):
https://lists.openembedded.org/g/openembedded-core/message/243295
Mute This Topic: https://lists.openembedded.org/mt/120717114/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
