[OE-core][PATCH v4 0/4] Make signed kernel modules stripped

[OE-core][PATCH v4 0/4] Make signed kernel modules stripped

[Anis Bougrine]

- Re-sign modules after the package stripping process.
- Remove the package-stripping skip for signed modules from package.py.
- Add MOD_INSTALL_PREFIX variable

Note that this v4 patch drops v3 patch and its relative which have been merged to master-next:
3e34657 kernel.bbclass: add strip process for signed kernel modules
ffc6d51 package: extract debug sources from signed kernel modules

Anis Bougrine (4):
  kernel.bbclass: re-sign kernel modules after package stripping process
  package.py: remove stripping and splitting skip for signed kernel
    modules
  kernel: centralize kernel module installation path in one variable
  documentation.conf: add documentation for MOD_INSTALL_PREFIX variable

 .../kernel-module-split.bbclass               | 23 ++++++++++++++++
 meta/classes-recipe/kernel.bbclass            | 13 +++++-----
 meta/conf/documentation.conf                  |  1 +
 meta/lib/oe/package.py                        | 26 +++----------------
 4 files changed, 34 insertions(+), 29 deletions(-)

-- 
2.50.1 (Apple Git-155)

[OE-core][PATCH v4 1/4] kernel.bbclass: re-sign kernel modules after package stripping process

[Anis Bougrine]

Fixes [YOCTO #12927]

Currently, signed kernel modules are not stripped in order to preserve
their valid signatures. See commit 4c47e5f.

Therefore, this commit makes kernel modules stripped and correctly
signed. Two options are possible:

    - Strip the kernel modules after installation and before signing.
    - Re-sign the kernel modules after stripping and before package splitting.

The first option was rejected because debug symbols would be dropped early
in the build workflow, which may impact the SPDX process.

The second option is adopted because it does not impact the build flow.

Reported-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
---
    changes in v4:
    
    - Re-sign kernel modules after package stripping process
    - Remove package-stripping skip in package.py
    - Add MOD_INSTALL_PREFIX variable
    
    changes in v3:
    
    - Fixing rebase issue.
    
    changes in v2:
    
    - Use the conditional INSTALL_MOD_STRIP environment variable to avoid
      duplicating the oe_runmake call.
    - Use `scripts/config` script instead of grepping .config file.
---
 .../kernel-module-split.bbclass               | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/meta/classes-recipe/kernel-module-split.bbclass b/meta/classes-recipe/kernel-module-split.bbclass
index ab2f0d1c37..253a723b95 100644
--- a/meta/classes-recipe/kernel-module-split.bbclass
+++ b/meta/classes-recipe/kernel-module-split.bbclass
@@ -35,6 +35,11 @@ modprobedir ??= "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '${nonarch_b
 
 KERNEL_SPLIT_MODULES ?= "1"
 PACKAGESPLITFUNCS =+ "split_kernel_module_packages"
+# Order matters:
+# 1. Strip the modules
+# 2. Re-sign the modules (if enabled)
+# 3. Split the packages
+PACKAGESPLITFUNCS =+ "post_strip_kernel_modules_signing"
 
 KERNEL_MODULES_META_PACKAGE ?= "${@ d.getVar("KERNEL_PACKAGE_NAME") or "kernel" }-modules"
 
@@ -42,6 +47,22 @@ KERNEL_MODULE_PACKAGE_PREFIX ?= ""
 KERNEL_MODULE_PACKAGE_SUFFIX ?= "-${KERNEL_VERSION}"
 KERNEL_MODULE_PROVIDE_VIRTUAL ?= "1"
 
+# Sign kernel modules if auto-signing is enabled in the kernel config
+post_strip_kernel_modules_signing(){
+    # Read .config values
+    is_modules="$(${S}/scripts/config --file ${B}/.config --state MODULES)"
+    is_module_sig="$(${S}/scripts/config --file ${B}/.config --state MODULE_SIG)"
+    is_module_sig_all="$(${S}/scripts/config --file ${B}/.config --state MODULE_SIG_ALL)"
+
+    if [ "$is_modules" = "y" ] && [ "$is_module_sig" = "y" ] && [ "$is_module_sig_all" = "y" ]; then
+        # Sign modules under ${PKGD}
+        oe_runmake \
+            -C ${B} \
+            MODLIB=${PKGD}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
+            modules_sign
+    fi
+}
+
 python split_kernel_module_packages () {
     import re
 
-- 
2.50.1 (Apple Git-155)

[OE-core][PATCH v4 2/4] package.py: remove stripping and splitting skip for signed kernel modules

[Anis Bougrine]

Fixes [YOCTO #12927]

Now kernel modules are re-signed after package stripping process.
Therefore, they can be stripped and splitted securely.

Reported-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
---
    changes in v4:
    
    - Re-sign kernel modules after package stripping process
    - Remove package-stripping skip in package.py
    - Add MOD_INSTALL_PREFIX variable
    
    changes in v3:
    
    - Fixing rebase issue.
    
    changes in v2:
    
    - Use the conditional INSTALL_MOD_STRIP environment variable to avoid
      duplicating the oe_runmake call.
    - Use `scripts/config` script instead of grepping .config file.
---
 meta/lib/oe/package.py | 26 +++-----------------------
 1 file changed, 3 insertions(+), 23 deletions(-)

diff --git a/meta/lib/oe/package.py b/meta/lib/oe/package.py
index 4a244ec980..1657eaad93 100644
--- a/meta/lib/oe/package.py
+++ b/meta/lib/oe/package.py
@@ -36,16 +36,9 @@ def runstrip(file, elftype, strip, extra_strip_sections=''):
         os.chmod(file, newmode)
 
     stripcmd = [strip]
-    skip_strip = False
-    # kernel module: use --strip-debug and --preserve-dates (required for
-    # module signing to remain valid after stripping)
+    # kernel module
     if elftype & 16:
-        if is_kernel_module_signed(file):
-            bb.debug(1, "Skip strip on signed module %s" % file)
-            skip_strip = True
-        else:
-            stripcmd.extend(["--strip-debug", "--remove-section=.comment",
-                "--remove-section=.note", "--preserve-dates"])
+        stripcmd.extend(["--strip-debug", "--remove-section=.comment", "--remove-section=.note"])
     # .so and shared library
     elif ".so" in file and elftype & 8:
         stripcmd.extend(["--remove-section=.comment", "--remove-section=.note", "--strip-unneeded"])
@@ -59,8 +52,7 @@ def runstrip(file, elftype, strip, extra_strip_sections=''):
     stripcmd.append(file)
     bb.debug(1, "runstrip: %s" % stripcmd)
 
-    if not skip_strip:
-        output = subprocess.check_output(stripcmd, stderr=subprocess.STDOUT)
+    output = subprocess.check_output(stripcmd, stderr=subprocess.STDOUT)
 
     if newmode:
         os.chmod(file, origmode)
@@ -70,13 +62,6 @@ def is_kernel_module(path):
     with open(path) as f:
         return mmap.mmap(f.fileno(), 0, prot=mmap.PROT_READ).find(b"vermagic=") >= 0
 
-# Detect if .ko module is signed
-def is_kernel_module_signed(path):
-    with open(path, "rb") as f:
-        f.seek(-28, 2)
-        module_tail = f.read()
-        return "Module signature appended" in "".join(chr(c) for c in bytearray(module_tail))
-
 # Return type (bits):
 # 0 - not elf
 # 1 - ELF
@@ -810,11 +795,6 @@ def splitdebuginfo(file, dvar, dv, d):
     debugfile = dvar + dest
     sources = []
 
-    if file.endswith(".ko") and file.find("/lib/modules/") != -1:
-        if oe.package.is_kernel_module_signed(file):
-            bb.debug(1, "Skip strip on signed module %s" % file)
-            return (file, sources)
-
     # Split the file...
     bb.utils.mkdirhier(os.path.dirname(debugfile))
     #bb.note("Split %s -> %s" % (file, debugfile))
-- 
2.50.1 (Apple Git-155)

[OE-core][PATCH v4 3/4] kernel: centralize kernel module installation path in one variable

[Anis Bougrine]

The kernel module installation path is currently defined in multiple
places, although it is used 10 times throughout the code. This
increases the risk of bugs due to inconsistencies or desynchronization.

Centralizing the path in a single variable makes the code more
reliable and easier to maintain.

Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
---
    changes in v4:
    
    - Re-sign kernel modules after package stripping process
    - Remove package-stripping skip in package.py
    - Add MOD_INSTALL_PREFIX variable
    
    changes in v3:
    
    - Fixing rebase issue.
    
    changes in v2:
    
    - Use the conditional INSTALL_MOD_STRIP environment variable to avoid
      duplicating the oe_runmake call.
    - Use `scripts/config` script instead of grepping .config file.
---
 meta/classes-recipe/kernel-module-split.bbclass |  4 +++-
 meta/classes-recipe/kernel.bbclass              | 13 +++++++------
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/meta/classes-recipe/kernel-module-split.bbclass b/meta/classes-recipe/kernel-module-split.bbclass
index 253a723b95..061522fc22 100644
--- a/meta/classes-recipe/kernel-module-split.bbclass
+++ b/meta/classes-recipe/kernel-module-split.bbclass
@@ -48,6 +48,8 @@ KERNEL_MODULE_PACKAGE_SUFFIX ?= "-${KERNEL_VERSION}"
 KERNEL_MODULE_PROVIDE_VIRTUAL ?= "1"
 
 # Sign kernel modules if auto-signing is enabled in the kernel config
+# MOD_INSTALL_PREFIX must be the same at installation and signing time.
+MOD_INSTALL_PREFIX ?= "${nonarch_base_libdir}/modules/${KERNEL_VERSION}"
 post_strip_kernel_modules_signing(){
     # Read .config values
     is_modules="$(${S}/scripts/config --file ${B}/.config --state MODULES)"
@@ -58,7 +60,7 @@ post_strip_kernel_modules_signing(){
         # Sign modules under ${PKGD}
         oe_runmake \
             -C ${B} \
-            MODLIB=${PKGD}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
+            MODLIB=${PKGD}${MOD_INSTALL_PREFIX} \
             modules_sign
     fi
 }
diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
index a82bdf7ecb..18bad854ce 100644
--- a/meta/classes-recipe/kernel.bbclass
+++ b/meta/classes-recipe/kernel.bbclass
@@ -38,6 +38,7 @@ S = "${STAGING_KERNEL_DIR}"
 B = "${WORKDIR}/build"
 KBUILD_OUTPUT = "${B}"
 OE_TERMINAL_EXPORTS += "KBUILD_OUTPUT"
+MOD_INSTALL_PREFIX = "${nonarch_base_libdir}/modules/${KERNEL_VERSION}"
 
 # we include gcc above, we dont need virtual/libc
 INHIBIT_DEFAULT_DEPS = "1"
@@ -453,11 +454,11 @@ kernel_do_install() {
 	#
 	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
 	if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
-		oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install
-		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
-		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source"
+		oe_runmake DEPMOD=echo MODLIB=${D}${MOD_INSTALL_PREFIX} INSTALL_FW_PATH=${D}${firmwaredir} modules_install
+		rm -f "${D}${MOD_INSTALL_PREFIX}/build"
+		rm -f "${D}${MOD_INSTALL_PREFIX}/source"
 		# Remove empty module directories to prevent QA issues
-		[ -d "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/kernel" ] && find "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/kernel" -type d -empty -delete
+		[ -d "${D}${MOD_INSTALL_PREFIX}/kernel" ] && find "${D}${MOD_INSTALL_PREFIX}/kernel" -type d -empty -delete
 	else
 		bbnote "no modules to install"
 	fi
@@ -680,9 +681,9 @@ EXPORT_FUNCTIONS do_compile do_transform_kernel do_transform_bundled_initramfs d
 # kernel-image becomes kernel-image-${KERNEL_VERSION}
 PACKAGES = "${KERNEL_PACKAGE_NAME} ${KERNEL_PACKAGE_NAME}-base ${KERNEL_PACKAGE_NAME}-vmlinux ${KERNEL_PACKAGE_NAME}-image ${KERNEL_PACKAGE_NAME}-dev ${KERNEL_PACKAGE_NAME}-modules ${KERNEL_PACKAGE_NAME}-dbg"
 FILES:${PN} = ""
-FILES:${KERNEL_PACKAGE_NAME}-base = "${nonarch_base_libdir}/modules/${KERNEL_VERSION}/modules.order ${nonarch_base_libdir}/modules/${KERNEL_VERSION}/modules.builtin ${nonarch_base_libdir}/modules/${KERNEL_VERSION}/modules.builtin.modinfo"
+FILES:${KERNEL_PACKAGE_NAME}-base = "${MOD_INSTALL_PREFIX}/modules.order ${MOD_INSTALL_PREFIX}/modules.builtin ${MOD_INSTALL_PREFIX}/modules.builtin.modinfo"
 FILES:${KERNEL_PACKAGE_NAME}-image = ""
-FILES:${KERNEL_PACKAGE_NAME}-dev = "/${KERNEL_IMAGEDEST}/System.map* /${KERNEL_IMAGEDEST}/Module.symvers* /${KERNEL_IMAGEDEST}/config* ${KERNEL_SRC_PATH} ${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
+FILES:${KERNEL_PACKAGE_NAME}-dev = "/${KERNEL_IMAGEDEST}/System.map* /${KERNEL_IMAGEDEST}/Module.symvers* /${KERNEL_IMAGEDEST}/config* ${KERNEL_SRC_PATH} ${MOD_INSTALL_PREFIX}/build"
 FILES:${KERNEL_PACKAGE_NAME}-vmlinux = "/${KERNEL_IMAGEDEST}/vmlinux-${KERNEL_VERSION_NAME}"
 FILES:${KERNEL_PACKAGE_NAME}-modules = ""
 FILES:${KERNEL_PACKAGE_NAME}-dbg = "/usr/lib/debug /usr/src/debug"
-- 
2.50.1 (Apple Git-155)

[OE-core][PATCH v4 4/4] documentation.conf: add documentation for MOD_INSTALL_PREFIX variable

[Anis Bougrine]

Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
---
    changes in v4:
    
    - Re-sign kernel modules after package stripping process
    - Remove package-stripping skip in package.py
    - Add MOD_INSTALL_PREFIX variable
    
    changes in v3:
    
    - Fixing rebase issue.
    
    changes in v2:
    
    - Use the conditional INSTALL_MOD_STRIP environment variable to avoid
      duplicating the oe_runmake call.
    - Use `scripts/config` script instead of grepping .config file.
---
 meta/conf/documentation.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/conf/documentation.conf b/meta/conf/documentation.conf
index 72513296e2..453190f024 100644
--- a/meta/conf/documentation.conf
+++ b/meta/conf/documentation.conf
@@ -282,6 +282,7 @@ MAINTAINER[doc] = "The email address of the distribution maintainer."
 MIRRORS[doc] = "Specifies additional paths from which the OpenEmbedded build system gets source code."
 MLPREFIX[doc] = "Specifies a prefix has been added to PN to create a special version of a recipe or package, such as a Multilib version."
 MODULE_TARBALL_DEPLOY[doc] = "Controls creation of the modules-*.tgz file. Set this variable to "0" to disable creation of this file, which contains all of the kernel modules resulting from a kernel build."
+MOD_INSTALL_PREFIX[doc] = "When a recipe inherits the module class, this variable specifies the directory to which kernel modules are installed on target."
 MULTIMACH_TARGET_SYS[doc] = "Separates files for different machines such that you can build for multiple target machines using the same output directories."
 
 #N
-- 
2.50.1 (Apple Git-155)

Re: [OE-core][PATCH v4 0/4] Make signed kernel modules stripped

[Mathieu Dubois-Briand]

On Sat Aug 22, 2026 at 2:25 AM CEST, Anis Bougrine via lists.openembedded.org wrote:
> - Re-sign modules after the package stripping process.
> - Remove the package-stripping skip for signed modules from package.py.
> - Add MOD_INSTALL_PREFIX variable
>
> Note that this v4 patch drops v3 patch and its relative which have been merged to master-next:
> 3e34657 kernel.bbclass: add strip process for signed kernel modules
> ffc6d51 package: extract debug sources from signed kernel modules
>
> Anis Bougrine (4):
>   kernel.bbclass: re-sign kernel modules after package stripping process
>   package.py: remove stripping and splitting skip for signed kernel
>     modules
>   kernel: centralize kernel module installation path in one variable
>   documentation.conf: add documentation for MOD_INSTALL_PREFIX variable
>
>  .../kernel-module-split.bbclass               | 23 ++++++++++++++++
>  meta/classes-recipe/kernel.bbclass            | 13 +++++-----
>  meta/conf/documentation.conf                  |  1 +
>  meta/lib/oe/package.py                        | 26 +++----------------
>  4 files changed, 34 insertions(+), 29 deletions(-)

Hi Anis,

Thanks for your patch.

I suspect this is related with this failure:

ERROR: lttng-modules-2.15.3-r0 do_package: Execution of '/srv/pokybuild/yocto-worker/genericx86/build/build/tmp/work/genericx86-poky-linux/lttng-modules/2.15.3/temp/run.post_strip_kernel_modules_signing.1005048' failed with exit code 127
...
| DEBUG: runstrip: ['i686-poky-linux-strip', '--strip-debug', '--remove-section=.comment', '--remove-section=.note', '/srv/pokybuild/yocto-worker/genericx86/build/build/tmp/work/genericx86-poky-linux/lttng-modules/2.15.3/package/lib/modules/6.18.43-yocto-standard/kernel/lttng-modules/tests/lttng-test.ko']
| DEBUG: runstrip: ['i686-poky-linux-strip', '--strip-debug', '--remove-section=.comment', '--remove-section=.note', '/srv/pokybuild/yocto-worker/genericx86/build/build/tmp/work/genericx86-poky-linux/lttng-modules/2.15.3/package/lib/modules/6.18.43-yocto-standard/kernel/lttng-modules/tests/lttng-clock-plugin-test.ko']
| DEBUG: runstrip: ['i686-poky-linux-strip', '--strip-debug', '--remove-section=.comment', '--remove-section=.note', '/srv/pokybuild/yocto-worker/genericx86/build/build/tmp/work/genericx86-poky-linux/lttng-modules/2.15.3/package/lib/modules/6.18.43-yocto-standard/kernel/lttng-modules/probes/lttng-probe-x86-irq-vectors.ko']
...

https://autobuilder.yoctoproject.org/valkyrie/#/builders/19/builds/4453
https://autobuilder.yoctoproject.org/valkyrie/#/builders/9/builds/4424
https://autobuilder.yoctoproject.org/valkyrie/#/builders/6/builds/4481

Can you have a look at the issue?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [OE-core][PATCH v4 0/4] Make signed kernel modules stripped

[Bougrine Anis]

[-- Attachment #1: Type: text/plain, Size: 3445 bytes --]

Hello Mathieu,

Thank you for your feedback. Yes, I'd be happy to investigate the issue.
In fact, I tested the patch only with core-image-minimal, i.e. only with
in-tree kernel modules.
However, it appears that the patch also needs to be adapted to support
out-of-tree modules.
I will work on that. I already have an idea of how to do it, and I will
keep you updated.

BR,
Anis

On Sat, Aug 22, 2026 at 6:12 PM Mathieu Dubois-Briand <
mathieu.dubois-briand@bootlin.com> wrote:

> On Sat Aug 22, 2026 at 2:25 AM CEST, Anis Bougrine via
> lists.openembedded.org wrote:
> > - Re-sign modules after the package stripping process.
> > - Remove the package-stripping skip for signed modules from package.py.
> > - Add MOD_INSTALL_PREFIX variable
> >
> > Note that this v4 patch drops v3 patch and its relative which have been
> merged to master-next:
> > 3e34657 kernel.bbclass: add strip process for signed kernel modules
> > ffc6d51 package: extract debug sources from signed kernel modules
> >
> > Anis Bougrine (4):
> >   kernel.bbclass: re-sign kernel modules after package stripping process
> >   package.py: remove stripping and splitting skip for signed kernel
> >     modules
> >   kernel: centralize kernel module installation path in one variable
> >   documentation.conf: add documentation for MOD_INSTALL_PREFIX variable
> >
> >  .../kernel-module-split.bbclass               | 23 ++++++++++++++++
> >  meta/classes-recipe/kernel.bbclass            | 13 +++++-----
> >  meta/conf/documentation.conf                  |  1 +
> >  meta/lib/oe/package.py                        | 26 +++----------------
> >  4 files changed, 34 insertions(+), 29 deletions(-)
>
> Hi Anis,
>
> Thanks for your patch.
>
> I suspect this is related with this failure:
>
> ERROR: lttng-modules-2.15.3-r0 do_package: Execution of
> '/srv/pokybuild/yocto-worker/genericx86/build/build/tmp/work/genericx86-poky-linux/lttng-modules/2.15.3/temp/run.post_strip_kernel_modules_signing.1005048'
> failed with exit code 127
> ...
> | DEBUG: runstrip: ['i686-poky-linux-strip', '--strip-debug',
> '--remove-section=.comment', '--remove-section=.note',
> '/srv/pokybuild/yocto-worker/genericx86/build/build/tmp/work/genericx86-poky-linux/lttng-modules/2.15.3/package/lib/modules/6.18.43-yocto-standard/kernel/lttng-modules/tests/lttng-test.ko']
> | DEBUG: runstrip: ['i686-poky-linux-strip', '--strip-debug',
> '--remove-section=.comment', '--remove-section=.note',
> '/srv/pokybuild/yocto-worker/genericx86/build/build/tmp/work/genericx86-poky-linux/lttng-modules/2.15.3/package/lib/modules/6.18.43-yocto-standard/kernel/lttng-modules/tests/lttng-clock-plugin-test.ko']
> | DEBUG: runstrip: ['i686-poky-linux-strip', '--strip-debug',
> '--remove-section=.comment', '--remove-section=.note',
> '/srv/pokybuild/yocto-worker/genericx86/build/build/tmp/work/genericx86-poky-linux/lttng-modules/2.15.3/package/lib/modules/6.18.43-yocto-standard/kernel/lttng-modules/probes/lttng-probe-x86-irq-vectors.ko']
> ...
>
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/19/builds/4453
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/9/builds/4424
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/6/builds/4481
>
> Can you have a look at the issue?
>
> Thanks,
> Mathieu
>
> --
> Mathieu Dubois-Briand, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com
>
>

[-- Attachment #2: Type: text/html, Size: 4585 bytes --]

Re: [OE-core][PATCH v4 3/4] kernel: centralize kernel module installation path in one variable

[Richard Purdie]

On Sat, 2026-08-22 at 02:26 +0200, Anis Bougrine wrote:
> The kernel module installation path is currently defined in multiple
> places, although it is used 10 times throughout the code. This
> increases the risk of bugs due to inconsistencies or desynchronization.
> 
> Centralizing the path in a single variable makes the code more
> reliable and easier to maintain.
> 
> Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
> ---
>     changes in v4:
>     
>     - Re-sign kernel modules after package stripping process
>     - Remove package-stripping skip in package.py
>     - Add MOD_INSTALL_PREFIX variable
>     
>     changes in v3:
>     
>     - Fixing rebase issue.
>     
>     changes in v2:
>     
>     - Use the conditional INSTALL_MOD_STRIP environment variable to avoid
>       duplicating the oe_runmake call.
>     - Use `scripts/config` script instead of grepping .config file.
> ---
>  meta/classes-recipe/kernel-module-split.bbclass |  4 +++-
>  meta/classes-recipe/kernel.bbclass              | 13 +++++++------
>  2 files changed, 10 insertions(+), 7 deletions(-)
> 
> diff --git a/meta/classes-recipe/kernel-module-split.bbclass b/meta/classes-recipe/kernel-module-split.bbclass
> index 253a723b95..061522fc22 100644
> --- a/meta/classes-recipe/kernel-module-split.bbclass
> +++ b/meta/classes-recipe/kernel-module-split.bbclass
> @@ -48,6 +48,8 @@ KERNEL_MODULE_PACKAGE_SUFFIX ?= "-${KERNEL_VERSION}"
>  KERNEL_MODULE_PROVIDE_VIRTUAL ?= "1"
>  
>  # Sign kernel modules if auto-signing is enabled in the kernel config
> +# MOD_INSTALL_PREFIX must be the same at installation and signing time.
> +MOD_INSTALL_PREFIX ?= "${nonarch_base_libdir}/modules/${KERNEL_VERSION}"
>  post_strip_kernel_modules_signing(){
>      # Read .config values
>      is_modules="$(${S}/scripts/config --file ${B}/.config --state MODULES)"

Rather than setting that in two places, you could set it once in
kernel-arch.bbclass. I did a bit of work to try and allow common things
to go in one place...

This series looks like a much better solution to the signing issue btw,
thanks!

Cheers,

Richard

RE: [OE-core][PATCH v4 0/4] Make signed kernel modules stripped

[Peter Kjellerstedt]

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Anis Bougrine via lists.openembedded.org
> Sent: den 22 augusti 2026 02:26
> To: openembedded-core@lists.openembedded.org
> Cc: antonin.godard@bootlin.com; bruce.ashfield@gmail.com; jose.quaresma@oss.qualcomm.com; richard.purdie@linuxfoundation.org; Anis Bougrine <anis.bougrine10@gmail.com>
> Subject: [OE-core][PATCH v4 0/4] Make signed kernel modules stripped
> 
> - Re-sign modules after the package stripping process.
> - Remove the package-stripping skip for signed modules from package.py.
> - Add MOD_INSTALL_PREFIX variable

Other module related variables in kernel-module-split.bbclass 
are prefixed with KERNEL_MODULE_ so I think it would be more 
consistent to name the variable KERNEL_MODULE_INSTALL_PREFIX.

> 
> Note that this v4 patch drops v3 patch and its relative which have been merged to master-next:
> 3e34657 kernel.bbclass: add strip process for signed kernel modules
> ffc6d51 package: extract debug sources from signed kernel modules
> 
> Anis Bougrine (4):
>   kernel.bbclass: re-sign kernel modules after package stripping process
>   package.py: remove stripping and splitting skip for signed kernel
>     modules
>   kernel: centralize kernel module installation path in one variable
>   documentation.conf: add documentation for MOD_INSTALL_PREFIX variable
> 
>  .../kernel-module-split.bbclass               | 23 ++++++++++++++++
>  meta/classes-recipe/kernel.bbclass            | 13 +++++-----
>  meta/conf/documentation.conf                  |  1 +
>  meta/lib/oe/package.py                        | 26 +++----------------
>  4 files changed, 34 insertions(+), 29 deletions(-)
> 
> --
> 2.50.1 (Apple Git-155)

//Peter