On 2026-07-01 3:43 PM, Nicolas Chauvet wrote:
- AWS is a not a prefered way to service our users at this step (while it is commonly available, it does not qualify as FLOSS, but not an AWS expert)
AWS is where the hardware is located, but the software used for the builds is all FLOSS. The only thing that stands out as being potentially "not open" is AWS KMS, which provides an HSM that handles signing. A local HSM is similarly not open.
- The Fedora way to secure the keys and sign is kind of already existing (the ansible infrastructure playbook is well detailed with that respect), I have a preference to follow that path (if ever it worth it).
Right, Fedora's infrastructure design was one of the references used for the infrastructure design. I'm not doing anything really new with the signing process. The signed code stack just uses an HSM in a cloud environment to ensure that the signing keys can't be compromised.
The design of this stack is intended to be close to the way that Red Hat and Fedora sign kernels and modules: using pesign and an HSM. Though, their implementation is moving toward decoupling the HSM from the build agent using sigul, while the KMS HSM is naturally decoupled from the build agent allowing for a simpler implementation.
- Basically, having pre-build kmod for a given kernel is a well defined technique, we used that in the past, so it's a no brainer, at least on local system or using mock. The issue is to automate with our buildsys (koji) for the long run.
Certainly, you could run a koji agent in AWS in order to utilize the KMS HSM. I'm using a forgejo agent so that I don't have to spin up koji.
- Our nvidia-open-kmod already have all the needed macros to ease the build using copr (seehttps://github.com/rpmfusion/nvidia-open-kmod and was demonstrated at https://copr.fedorainfracloud.org/coprs/kwizart/nvidia-driver-rawhide/package/nvidia-open-kmod/), a better way will be to notify on new kernel-devel changes rather than pooling for updates.
Right, that's one of the things I've built. One of the two instances listens to the fedora message bus for notifications that a new kernel package has been built:
https://codeberg.org/project-resistor/signed-code-build-stack/src/branch/main/scripts/message-listener.py
- Most corporate users can use akmod on a secured virtual machine and generate the pre-built kmod from there for a given fedora release. (then re-import their pre-built kmod in pulp or alikes).
That's possible, but as far as I know, kmodtool (and by extension akmods) doesn't support the use of an HSM, and one of my goals is to offer more secure processes for this sort of thing. And the possibility of locally hosted signing systems doesn't do much to help RPMFusion's user base, most of whom I would guess do not have the infrastructure or expertise to spin up such a thing.
_______________________________________________ rpmfusion-developers mailing list -- [email protected] To unsubscribe send an email to [email protected]
