Arch Linux

There's a PR open for this upstream:

https://github.com/dell/dkms/pull/230

That PR does not work with 3.0.5-1:


==> Starting prepare()...
-> Applying patch 230.patch
patching file dkms.in
patching file dkms.in
Reversed (or previously applied) patch detected! Skipping patch.
2 out of 2 hunks ignored -- saving rejects to file dkms.in.rej


However, this should:

sed -i 's/sha512/sha512sum/g' "$pkgname.in"

Changing `sha512` to `sha512sum` is incorrect, `sha512` is an option being passed to the `kmodsign` (line 1030) or `$sign_file` (line 1033) command.

See patch below.

I do not use signed modules, so I'm not affected by this.
Is this an issue only for users who enforce module signature with module.sig_enforce=1?
Is setting module.sig_enforce=0 a workaround?

The commit that broke this: https://github.com/dell/dkms/commit/3323033dfdc5f58afc303736f6b580bf62442ef7

The problem is the authors converted from `kmodsign` (which I, as a non-UEFI user do not have installed) so the previous code properly stopped trying to sign a module if that was missing.

```
sign_build()
{
[[ -x "$(command -v kmodsign)" && -d "/var/lib/shim-signed/mok/" ]] || return
```

The newly updated code just sets up `do_signing` regardless of any missing tools, so it's more broken than just one missing variable -- on my system it simply should not be trying to sign any modules at all as it's a BIOS boot, not UEFI (meaning the new broken code for missing `sign_file` should not even be reached, the new code breaks the logic).

https://github.com/dell/dkms/issues/162

Arch needs to set the following in the dkms config:

sign_file='/usr/lib/modules/${kernelver}/build/scripts/sign-file'

The single quotes are necessary because $kernelver is not yet set when the configuration files are sourced.

The attached diffs seem to fix it.

I confirm. Defining sign_file helps with this problem.
https://github.com/dell/dkms/blob/187980ac51650b02225f9a13a7ed99b8e01d062c/dkms_framework.conf#L28
sign_file='/usr/lib/modules/${kernelver}/build/scripts/sign-file'

Rebuild with the patch above helps too.

Not sure where the fix/patch for this stands, but as of 7/9/22 with the new dkms 3.0.5-1, I still get:

(13/27) Install DKMS modules
==> dkms install --no-depmod vboxhost/6.1.35_non_OSE -k 5.18.9-arch1-1
/usr/bin/dkms: line 1033: sha512: command not found
/usr/bin/dkms: line 1033: sha512: command not found
/usr/bin/dkms: line 1033: sha512: command not found

@drankinatty `3.0.5-1` is the broken one (and latest package available), you can either attempt to patch it yourself using test patches in this issue, or you could downgrade to the previous package 3.0.3 for the time being. If choosing the latter, this nifty tool can help: https://aur.archlinux.org/packages/downgrade

I just sent a message to Sébastien asking about the status.

> https://aur.archlinux.org/packages/downgrade
without third-party programs, downgrade can be done using pacman itself:
sudo pacman -U https://archive.archlinux.org/packages/d/dkms/dkms-3.0.3-1-any.pkg.tar.zst

and just tell pacman to keep old dkms version

to file
/etc/pacman.conf
add line (or add dkms if IgnorePkg list is not empty)
IgnorePkg = dkms

then when you know the problem is solved - tell pacman to stop ignoring dkms updates by removing that line or package name.

Or you can just ignore the errors for now, since they don't mean anything. Downgrading for this is massive overkill.

Should be fixed in dkms-3.0.5-2.

I early applied https://github.com/dell/dkms/pull/230.

I have no secure boot system, so please confirm it's a good fix.

> I have no secure boot system, so please confirm it's a good fix.
works for me, with dkms-3.0.5-2 does not have the initially described issue.