autoModuleSignHook: sign when aggregated

eadwu · Aug 17, 2020 · 4938fc4 · 4938fc4
1 parent 6366850
commit 4938fc4
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 5 deletions.
diff --git a/nixos/modules/system/boot/kernel.nix b/nixos/modules/system/boot/kernel.nix
@@ -166,7 +166,7 @@ in
         symlinks because modprobe only supports one directory.
       '';
       # Convert the list of path to only one path.
-      apply = pkgs.aggregateModules;
+      apply = pkgs.aggregateModules config.boot.kernelPackages.autoModuleSignHook;
     };
 
     system.requiredKernelConfig = mkOption {

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -49,7 +49,8 @@ let
 
   # Dependencies that are required to build kernel modules
   moduleBuildDependencies = optional (stdenv.lib.versionAtLeast version "4.14") libelf
-    ++ extraModuleBuildDependencies;
+    # ++ extraModuleBuildDependencies
+    ;
 
   installkernel = writeTextFile { name = "installkernel"; executable=true; text = ''
     #!${stdenv.shell} -e

diff --git a/pkgs/os-specific/linux/kmod/aggregator.nix b/pkgs/os-specific/linux/kmod/aggregator.nix
@@ -1,8 +1,10 @@
-{ stdenvNoCC, kmod, modules, buildEnv, name ? "kernel-modules" }:
+{ stdenvNoCC, kmod, modules, buildEnv, autoModuleSignHook, name ? "kernel-modules" }:
 
 buildEnv {
   inherit name;
 
+  buildInputs = [ autoModuleSignHook ];
+
   paths = modules;
 
   postBuild =
@@ -31,5 +33,7 @@ buildEnv {
           rm -f $out/lib/modules/$kernelVersion/modules.!(builtin*|order*)
           ${kmod}/bin/depmod -b $out -C $out/etc/depmod.d -a $kernelVersion
       fi
+
+      moduleSignPhase()
     '';
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
@@ -17439,6 +17439,13 @@ in
     # Obsolete aliases (these packages do not depend on the kernel).
     inherit (pkgs) odp-dpdk pktgen; # added 2018-05
 
+    autoModuleSignHook = makeSetupHook
+      { substitutions =
+        { kernel = kernel.dev + "/lib/modules/${kernel.modDirVersion}/build";
+          hash = if (kernel.configfile.structuredConfig ? MODULE_SIG_HASH)
+            then kernel.configfile.structuredConfig.MODULE_SIG_HASH.freeform else ""; }; }
+      ../os-specific/linux/kernel/sign-module.sh;
+
     acpi_call = callPackage ../os-specific/linux/acpi-call {};
 
     amdgpu-pro = callPackage ../os-specific/linux/amdgpu-pro { };
@@ -17819,10 +17826,10 @@ in
 
   mmc-utils = callPackage ../os-specific/linux/mmc-utils { };
 
-  aggregateModules = modules:
+  aggregateModules = autoModuleSignHook: modules:
     callPackage ../os-specific/linux/kmod/aggregator.nix {
       inherit (buildPackages) kmod;
-      inherit modules;
+      inherit modules autoModuleSignHook;
     };
 
   multipart-parser-c = callPackage ../development/libraries/multipart-parser-c { };