v2: added Signed-off-by
On Wed, Sep 16 2026 at 21:30:51 +02:00:00, Markus Volk via
lists.openembedded.org <[email protected]> wrote:
With CONFIG_MODULE_COMPRESS_ALL the kernel installs modules with a
compression suffix, and scripts/Makefile.modinst derives the
compressed
file from the signed uncompressed one, which is removed afterwards.
The modules_sign target then has nothing to sign below ${PKGD} and
do_package fails in sign-file with an openssl "no such file" error.
Re-signing is not needed there either: compressed modules are not ELF
files, so package stripping leaves them alone and the signature made
during modules_install is still valid.
Found on a raspberrypi4-64 kernel, which enables both MODULE_SIG_ALL
and MODULE_COMPRESS_XZ. Tested by building linux-raspberrypi through
do_package, which now packages 1861 signed .ko.xz modules.
AI-Generated: Uses Claude Code
Signed-off-by: Markus Volk <[email protected]
<mailto:[email protected]>>
---
meta/classes-recipe/kernel-module-split.bbclass | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/meta/classes-recipe/kernel-module-split.bbclass
b/meta/classes-recipe/kernel-module-split.bbclass
index 99c2d12962..9a7f04f37b 100644
--- a/meta/classes-recipe/kernel-module-split.bbclass
+++ b/meta/classes-recipe/kernel-module-split.bbclass
@@ -53,8 +53,15 @@ post_strip_kernel_modules_signing(){
is_modules="$(${STAGING_KERNEL_DIR}/scripts/config --file
${KBUILD_OUTPUT}/.config --state MODULES)"
is_module_sig="$(${STAGING_KERNEL_DIR}/scripts/config --file
${KBUILD_OUTPUT}/.config --state MODULE_SIG)"
is_module_sig_all="$(${STAGING_KERNEL_DIR}/scripts/config --file
${KBUILD_OUTPUT}/.config --state MODULE_SIG_ALL)"
-
- if [ "$is_modules" = "y" ] && [ "$is_module_sig" = "y" ] && [
"$is_module_sig_all" = "y" ]; then
+ is_module_compress_all="$(${STAGING_KERNEL_DIR}/scripts/config
--file ${KBUILD_OUTPUT}/.config --state MODULE_COMPRESS_ALL)"
+
+ # Compressed modules are not ELF files, so package stripping
leaves them
+ # untouched and the signature made during modules_install is
still valid.
+ # Re-signing them is not only unnecessary but fails: with
+ # CONFIG_MODULE_COMPRESS_ALL the install targets carry the
compression
+ # suffix, and the uncompressed module their rule depends on does
not
+ # exist below ${PKGD}.
+ if [ "$is_modules" = "y" ] && [ "$is_module_sig" = "y" ] && [
"$is_module_sig_all" = "y" ] && [ "$is_module_compress_all" != "y" ];
then
# Sign modules under ${PKGD}, with M= if out-of-tree module.
# Out-of-tree module Makefiles invoke the kernel Makefile by
appending M= (the module directory) to MAKEFLAGS.
# However, they usually do not provide a modules_sign
target. Therefore, the kernel modules_sign target has to
--
2.55.0
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#245996):
https://lists.openembedded.org/g/openembedded-core/message/245996
Mute This Topic: https://lists.openembedded.org/mt/121284810/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
