Le mer. 1 juil. 2026 à 23:18, gordon.messmer--- via rpmfusion-developers <[email protected]> a écrit : > > I've been working on the infrastructure needed to build and sign modules (and > kernels, for that matter) for Fedora. I think the work is > 90% done, so I > wanted to see if rpmfusion might be interested in deploying similar builds > for its users. > > Pre-built modules should help eliminate the relatively common case that users > disrupt a background build of the modules (or they fail for some other reason > like running out of disk space) resulting in a non-functional system after > reboot. They're also a lot easier to layer on Atomic systems. > > https://codeberg.org/project-resistor/signed-code-build-stack - Builds run in > an AWS VPC. There are two instances there, one that hosts a runner that > executes builds, with access to a key in an HSM (backed by AWS KMS), and a > second instance that listens to the Fedora messaging bus, which triggers > builds when a new kernel is submitted to the testing repo. > > https://codeberg.org/project-resistor-kernel/kmod-build-workflows - This > shared workflow is used by kernel module packages > > https://codeberg.org/project-resistor-kernel/nvidia-open-kmod - For example, > the NVIDIA OpenRM driver
Thanks for getting in touch and raising this point on this mailing list. I will have a deeper dive into your work in the next days, but at least for now. - AWS is a not a prefered way to service our users at this step (while it is commonly available, it does not qualify as FLOSS, but not an AWS expert) - The Fedora way to secure the keys and sign is kind of already existing (the ansible infrastructure playbook is well detailed with that respect), I have a preference to follow that path (if ever it worth it). Landing new services should be as easy as translating from https://forge.fedoraproject.org/infra/ansible/ to github.com/rpmfusion-infra/ansible-rpmfusion (help is welcomed in that area). - Basically, having pre-build kmod for a given kernel is a well defined technique, we used that in the past, so it's a no brainer, at least on local system or using mock. The issue is to automate with our buildsys (koji) for the long run. - Our nvidia-open-kmod already have all the needed macros to ease the build using copr (see https://github.com/rpmfusion/nvidia-open-kmod and was demonstrated at https://copr.fedorainfracloud.org/coprs/kwizart/nvidia-driver-rawhide/package/nvidia-open-kmod/), a better way will be to notify on new kernel-devel changes rather than pooling for updates. - Most corporate users can use akmod on a secured virtual machine and generate the pre-built kmod from there for a given fedora release. (then re-import their pre-built kmod in pulp or alikes). Having such setup is doable, but it's likely requires some resources and time, depending on who is doing the work and who is helping for the work to be done: See also https://rpmfusion.org/Contribute. Hope this helps going forward. _______________________________________________ rpmfusion-developers mailing list -- [email protected] To unsubscribe send an email to [email protected]
