v1.0.2 — Default boot kernel and signature verification

v1.0.2 — Default boot kernel and signature verification

v1.0.2 improves Fedora kernel selection and Secure Boot signature verification for v4l2loopback-manager.

Highlights

• Uses Fedora's configured default boot kernel as the build target.
• Detects the target kernel with grubby --default-kernel.
• Verifies that v4l2loopback.ko is signed by the expected MOK certificate.
• Rebuilds the module when it is missing, unsigned, unreadable, or signed by another key.
• Keeps needs-rebuild compatible with systemd ExecCondition= semantics.
• Adds grubby as a runtime dependency.

Kernel Selection

The manager now targets the kernel configured by Fedora as the default boot kernel:

sudo grubby --default-kernel

This avoids assuming that the numerically newest installed kernel or kernel-devel package is necessarily the kernel Fedora intends to boot.

Both:

needs-rebuild
rebuild

use the same target-kernel selection logic.

Secure Boot Verification

For the selected kernel, the manager checks:

/lib/modules/<kernel>/updates/v4l2loopback.ko

and verifies its signer with modinfo.

The expected signer is:

V4L2Loopback Module Signing

The module is rebuilt when it is:

missing
unsigned
unreadable
signed by another certificate

systemd Behavior

needs-rebuild is designed for:

ExecCondition=/usr/bin/v4l2loopback needs-rebuild

Its exit codes are:

0 → rebuild required
1 → module already valid

Therefore, systemd may show:

status=1/FAILURE
Skipped due to 'exec-condition'

when the module already exists and is correctly signed.

This is expected behavior and does not indicate a failed module build.

Installation

Enable the COPR repository:

sudo dnf copr enable hhlp/v4l2loopback

Install or upgrade:

sudo dnf install v4l2loopback-manager

or:

sudo dnf upgrade v4l2loopback-manager

Verify the installed version:

rpm -q v4l2loopback-manager

Verification

Check Fedora's default boot kernel:

sudo grubby --default-kernel

Check whether a rebuild is required:

sudo v4l2loopback needs-rebuild
echo $?

Inspect the module signer:

TARGET="$(sudo grubby --default-kernel)"
TARGET="${TARGET##*/}"
TARGET="${TARGET#vmlinuz-}"

modinfo -k "$TARGET" v4l2loopback |
    grep -E '^(filename|version|signer|sig_key|sig_hashalgo):'

Expected signer:

V4L2Loopback Module Signing

Upgrade Note

If v4l2loopback-rebuild.service was generated by an older release, regenerate it with:

sudo v4l2loopback disable-systemd
sudo v4l2loopback enable-systemd

Then verify:

systemctl status v4l2loopback-rebuild.service
systemctl is-enabled v4l2loopback-rebuild.service

Cleanup

Before removing the package, the recommended cleanup sequence is:

sudo v4l2loopback uninstall
sudo v4l2loopback disable-systemd
sudo dnf remove v4l2loopback-manager

Changes Since v1.0.1

• Use Fedora's default boot kernel as the module build target.
• Detect the target kernel using grubby --default-kernel.
• Verify module signatures against the expected MOK certificate.
• Rebuild missing or incorrectly signed modules.
• Preserve needs-rebuild semantics for systemd ExecCondition=.
• Add the grubby runtime dependency.
• Update systemd descriptions, documentation, and tests.

---

Package: v4l2loopback-manager
Release: v1.0.2
Platform: Fedora Linux
Manager: /usr/bin/v4l2loopback