Re: kernel-build.eclass: disable MOD_SIG

Based on mgorny's quick review, I have moved the merge_config
part outside of the if statement.

Thanks

immolo

From def03a97c874d4b47c89a233d0987610cb72d72a Mon Sep 17 00:00:00 2001
From: Ian Jordan <[email protected]>
Date: Wed, 27 May 2026 16:57:37 +0100
Subject: [PATCH] kernel-build.eclass: disable MOD_SIG

Add an else statement to remove Debian's on by
default module signing.

Signed-off-by: Ian Jordan <[email protected]>
---
 eclass/kernel-build.eclass | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/eclass/kernel-build.eclass b/eclass/kernel-build.eclass
index 14785efd8eed..d174e810c57d 100644
--- a/eclass/kernel-build.eclass
+++ b/eclass/kernel-build.eclass
@@ -740,9 +740,16 @@ kernel-build_merge_configs() {
  CONFIG_MODULE_SIG_FORCE=y
  CONFIG_MODULE_SIG_${MODULES_SIGN_HASH^^}=y
  EOF
- merge_configs+=( "${WORKDIR}/modules-sign.config" )
+ else
+ cat <<-EOF > "${WORKDIR}/modules-sign.config" || die
+ ## Disable module signing
+ CONFIG_MODULE_SIG=n
+ CONFIG_MODULE_SIG_ALL=n
+ EOF
  fi

+ merge_configs+=( "${WORKDIR}/modules-sign.config" )
+
  # Only semi-related but let's use that to avoid changing stable ebuilds.
  if [[ ${KERNEL_IUSE_GENERIC_UKI} ]]; then
  # NB: we enable support for compressed modules even with
-- 
2.54.0

On Wed, 27 May 2026 at 17:24, Immolo <[email protected]> wrote:
>
> Hi all,
>
> In preparation for extending sys-kernel/gentoo-kernel to support
> more arches, by allowing the use of Debian kernel configs for
> the niche systems that Fedora doesn't support. As part of the
> ongoing work in https://github.com/gentoo/gentoo/pull/46296
>
> Debian enables module signing by default which goes against
> our belief this should be a user choice.
>
> So if I have added an else statement to the kernel-build eclass
> which will unset those options when using -module-sign.
>
> Thanks to Nowa for quickly getting me up to speed on how the
> eclass works and saving me a ton of time.
>
> Thanks,
>
> immolo
>
> From ab6f877db15695dea61f77666c398930bd18a4ca Mon Sep 17 00:00:00 2001
> From: Ian Jordan <[email protected]>
> Date: Wed, 27 May 2026 16:57:37 +0100
> Subject: [PATCH] kernel-build.eclass: disable MOD_SIG
>
> Add an else statement to remove Debian's on by
> default module signing.
>
> Signed-off-by: Ian Jordan <[email protected]>
> ---
>  eclass/kernel-build.eclass | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/eclass/kernel-build.eclass b/eclass/kernel-build.eclass
> index 14785efd8eed..a96cfef9ae16 100644
> --- a/eclass/kernel-build.eclass
> +++ b/eclass/kernel-build.eclass
> @@ -741,6 +741,13 @@ kernel-build_merge_configs() {
>   CONFIG_MODULE_SIG_${MODULES_SIGN_HASH^^}=y
>   EOF
>   merge_configs+=( "${WORKDIR}/modules-sign.config" )
> + else
> + cat <<-EOF > "${WORKDIR}/modules-sign.config" || die
> + ## Disable module signing
> + CONFIG_MODULE_SIG=n
> + CONFIG_MODULE_SIG_ALL=n
> + EOF
> + merge_configs+=( "${WORKDIR}/modules-sign.config" )
>   fi
>
>   # Only semi-related but let's use that to avoid changing stable ebuilds.
> --
> 2.54.0