Re: [oe-core][PATCHv2] kernel-module-split: don't re-sign compressed kernel modules

Re: [oe-core][PATCHv2] kernel-module-split: don't re-sign compressed kernel modules

[Markus Volk]

[-- Attachment #1: Type: text/plain, Size: 3523 bytes --]

v2: added Signed-off-by

On Wed, Sep 16 2026 at 21:30:51 +02:00:00, Markus Volk via 
lists.openembedded.org <f_l_k=t-online.de@lists.openembedded.org> wrote:
> With CONFIG_MODULE_COMPRESS_ALL the kernel installs modules with a
> compression suffix, and scripts/Makefile.modinst derives the 
> compressed
> file from the signed uncompressed one, which is removed afterwards.
> The modules_sign target then has nothing to sign below ${PKGD} and
> do_package fails in sign-file with an openssl "no such file" error.
> 
> Re-signing is not needed there either: compressed modules are not ELF
> files, so package stripping leaves them alone and the signature made
> during modules_install is still valid.
> 
> Found on a raspberrypi4-64 kernel, which enables both MODULE_SIG_ALL
> and MODULE_COMPRESS_XZ. Tested by building linux-raspberrypi through
> do_package, which now packages 1861 signed .ko.xz modules.
> 
> AI-Generated: Uses Claude Code
> Signed-off-by: Markus Volk <f_l_k@t-online.de 
> <mailto:f_l_k@t-online.de>>
> ---
>  meta/classes-recipe/kernel-module-split.bbclass | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/meta/classes-recipe/kernel-module-split.bbclass 
> b/meta/classes-recipe/kernel-module-split.bbclass
> index 99c2d12962..9a7f04f37b 100644
> --- a/meta/classes-recipe/kernel-module-split.bbclass
> +++ b/meta/classes-recipe/kernel-module-split.bbclass
> @@ -53,8 +53,15 @@ post_strip_kernel_modules_signing(){
>      is_modules="$(${STAGING_KERNEL_DIR}/scripts/config --file 
> ${KBUILD_OUTPUT}/.config --state MODULES)"
>      is_module_sig="$(${STAGING_KERNEL_DIR}/scripts/config --file 
> ${KBUILD_OUTPUT}/.config --state MODULE_SIG)"
>      is_module_sig_all="$(${STAGING_KERNEL_DIR}/scripts/config --file 
> ${KBUILD_OUTPUT}/.config --state MODULE_SIG_ALL)"
> -
> -    if [ "$is_modules" = "y" ] && [ "$is_module_sig" = "y" ] && [ 
> "$is_module_sig_all" = "y" ]; then
> +    is_module_compress_all="$(${STAGING_KERNEL_DIR}/scripts/config 
> --file ${KBUILD_OUTPUT}/.config --state MODULE_COMPRESS_ALL)"
> +
> +    # Compressed modules are not ELF files, so package stripping 
> leaves them
> +    # untouched and the signature made during modules_install is 
> still valid.
> +    # Re-signing them is not only unnecessary but fails: with
> +    # CONFIG_MODULE_COMPRESS_ALL the install targets carry the 
> compression
> +    # suffix, and the uncompressed module their rule depends on does 
> not
> +    # exist below ${PKGD}.
> +    if [ "$is_modules" = "y" ] && [ "$is_module_sig" = "y" ] && [ 
> "$is_module_sig_all" = "y" ] && [ "$is_module_compress_all" != "y" ]; 
> then
>          # Sign modules under ${PKGD}, with M= if out-of-tree module.
>          # Out-of-tree module Makefiles invoke the kernel Makefile by 
> appending M= (the module directory) to MAKEFLAGS.
>          # However, they usually do not provide a modules_sign 
> target. Therefore, the kernel modules_sign target has to
> --
> 2.55.0
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#245995): 
> <https://lists.openembedded.org/g/openembedded-core/message/245995>
> Mute This Topic: <https://lists.openembedded.org/mt/121284810/3618223>
> Group Owner: openembedded-core+owner@lists.openembedded.org 
> <mailto:openembedded-core+owner@lists.openembedded.org>
> Unsubscribe: 
> <https://lists.openembedded.org/g/openembedded-core/unsub> 
> [f_l_k@t-online.de <mailto:f_l_k@t-online.de>]
> -=-=-=-=-=-=-=-=-=-=-=-
> 


[-- Attachment #2: Type: text/html, Size: 3922 bytes --]

[oe-core][PATCHv2] kernel-module-split: don't re-sign compressed kernel modules

[Markus Volk]

With CONFIG_MODULE_COMPRESS_ALL the kernel installs modules with a
compression suffix, and scripts/Makefile.modinst derives the compressed
file from the signed uncompressed one, which is removed afterwards.
The modules_sign target then has nothing to sign below ${PKGD} and
do_package fails in sign-file with an openssl "no such file" error.

Re-signing is not needed there either: compressed modules are not ELF
files, so package stripping leaves them alone and the signature made
during modules_install is still valid.

Found on a raspberrypi4-64 kernel, which enables both MODULE_SIG_ALL
and MODULE_COMPRESS_XZ. Tested by building linux-raspberrypi through
do_package, which now packages 1861 signed .ko.xz modules.

AI-Generated: Uses Claude Code
Signed-off-by: Markus Volk <f_l_k@t-online.de>
---
 meta/classes-recipe/kernel-module-split.bbclass | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/meta/classes-recipe/kernel-module-split.bbclass b/meta/classes-recipe/kernel-module-split.bbclass
index 99c2d12962..9a7f04f37b 100644
--- a/meta/classes-recipe/kernel-module-split.bbclass
+++ b/meta/classes-recipe/kernel-module-split.bbclass
@@ -53,8 +53,15 @@ post_strip_kernel_modules_signing(){
     is_modules="$(${STAGING_KERNEL_DIR}/scripts/config --file ${KBUILD_OUTPUT}/.config --state MODULES)"
     is_module_sig="$(${STAGING_KERNEL_DIR}/scripts/config --file ${KBUILD_OUTPUT}/.config --state MODULE_SIG)"
     is_module_sig_all="$(${STAGING_KERNEL_DIR}/scripts/config --file ${KBUILD_OUTPUT}/.config --state MODULE_SIG_ALL)"
-
-    if [ "$is_modules" = "y" ] && [ "$is_module_sig" = "y" ] && [ "$is_module_sig_all" = "y" ]; then
+    is_module_compress_all="$(${STAGING_KERNEL_DIR}/scripts/config --file ${KBUILD_OUTPUT}/.config --state MODULE_COMPRESS_ALL)"
+
+    # Compressed modules are not ELF files, so package stripping leaves them
+    # untouched and the signature made during modules_install is still valid.
+    # Re-signing them is not only unnecessary but fails: with
+    # CONFIG_MODULE_COMPRESS_ALL the install targets carry the compression
+    # suffix, and the uncompressed module their rule depends on does not
+    # exist below ${PKGD}.
+    if [ "$is_modules" = "y" ] && [ "$is_module_sig" = "y" ] && [ "$is_module_sig_all" = "y" ] && [ "$is_module_compress_all" != "y" ]; then
         # Sign modules under ${PKGD}, with M= if out-of-tree module.
         # Out-of-tree module Makefiles invoke the kernel Makefile by appending M= (the module directory) to MAKEFLAGS.
         # However, they usually do not provide a modules_sign target. Therefore, the kernel modules_sign target has to
-- 
2.55.0