Consider Merging: sign kernel modules on all archs in Fedora

On 10.12.2015 20:59, Josh Boyer wrote(¹): > > […] > > Thinking about it some, there isn't really a reason CONFIG_MODULE_SIG > > couldn't be enabled on other architectures. Signed modules are > > independent of UEFI secure boot support. If we did that, we might > > want to come up with something that maps arches which have it enabled > > to a single RPM macro. > > > > Anyway, that's likely future work. Find attached two patches to go down that route. The first creates a new macro in the spec file to make "signing modules" and "signing kernels for UEFI secure boot" independent from each other. This is pretty straightforward and could be applied as is, as afterwards it if more obvious what happens. I fired a scratch build to verify mod-sign and pesign are still called just like before on %{ix86} x86_64. Results can be found via http://koji.fedoraproject.org/koji/taskinfo?taskID=12376294 The arm build log shows that mod-sign and pesign are still not called. The second patch enables module signing for all archs. Scratch builds for primary archs: http://koji.fedoraproject.org/koji/taskinfo?taskID=12376883 Scratch build for ppc: http://ppc.koji.fedoraproject.org/koji/taskinfo?taskID=3033583 I for now didn't run any of those kernels to verify if things still work as I'm unsure what we want to do (hence the RFC in the Subject): On which archs do we want to enable module signing? Are there any reasons to not enable it on some archs? Is the overhead considered to big for armv7? Does it work everywhere?