Unsigned /lib/modules/6.14.2-1-liquorix binarys are not signed

[1nky]

Hi
apt updated today an got these messages should I be concerned:

/usr/sbin/dkms.mx autoinstall --kernelver 6.14.2-1-liquorix-amd64
Sign command: /lib/modules/6.14.2-1-liquorix-amd64/build/scripts/sign-file
Binary /lib/modules/6.14.2-1-liquorix-amd64/build/scripts/sign-file not found, modules won't be signed
Warning: The /var/lib/dkms/8812au/5.13.6/6.14.2-1-liquorix-amd64/x86_64/dkms.conf for module 8812au includes a BUILD_EXCLUSIVE directive which does not match this kernel/arch/config.
This indicates that it should not be built. Skipping..

Code: Select all

Snapshot created on: 20250225_1534
System:
  Kernel: 6.14.2-1-liquorix-amd64 [6.14-3~mx23ahs] arch: x86_64 bits: 64 compiler: gcc v: 12.2.0 parameters: audit=0
    intel_pstate=disable amd_pstate=disable BOOT_IMAGE=/boot/vmlinuz-6.14.2-1-liquorix-amd64
    root=UUID=<filter> ro quiet splash resume=UUID=<filter> resume_offset=113326080
  Desktop: KDE Plasma v: 5.27.5 wm: kwin_x11 vt: 7 dm: SDDM Distro: MX-23.6_KDE_x64 Libretto
    September 15 2024 base: Debian GNU/Linux 12 (bookworm)
Machine:
  Type: Desktop System: Micro-Star product: MS-7E27 v: 1.0 serial: <superuser required>
  Mobo: Micro-Star model: PRO B650M-P (MS-7E27) v: 1.0 serial: <superuser required> UEFI: American
    Megatrends LLC. v: 1.D1 date: 10/22/2024
Battery:
  Device-1: hidpp_battery_0 model: Logitech M350 Wireless Mouse serial: <filter> charge: 100%
    (should be ignored) rechargeable: yes status: discharging
CPU:
  Info: model: AMD Ryzen 7 7700X bits: 64 type: MT MCP arch: Zen 4 gen: 5 level: v4 note: check
    built: 2022+ process: TSMC n5 (5nm) family: 0x19 (25) model-id: 0x61 (97) stepping: 2
    microcode: 0xA601209
  Topology: cpus: 1x cores: 8 tpc: 2 threads: 16 smt: enabled cache: L1: 512 KiB
    desc: d-8x32 KiB; i-8x32 KiB L2: 8 MiB desc: 8x1024 KiB L3: 32 MiB desc: 1x32 MiB
  Speed (MHz): avg: 3078 high: 4500 min/max: 3000/4500 boost: enabled scaling:
    driver: acpi-cpufreq governor: ondemand cores: 1: 3000 2: 3000 3: 2876 4: 2880 5: 3000 6: 3000
    7: 3000 8: 4500 9: 3000 10: 3000 11: 3000 12: 3000 13: 3000 14: 3000 15: 3000 16: 3000
    bogomips: 143999
  Flags: avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 svm
  Vulnerabilities:
  Type: gather_data_sampling status: Not affected
  Type: ghostwrite status: Not affected
  Type: itlb_multihit status: Not affected
  Type: l1tf status: Not affected
  Type: mds status: Not affected
  Type: meltdown status: Not affected
  Type: mmio_stale_data status: Not affected
  Type: reg_file_data_sampling status: Not affected
  Type: retbleed status: Not affected
  Type: spec_rstack_overflow mitigation: Safe RET
  Type: spec_store_bypass mitigation: Speculative Store Bypass disabled via prctl
  Type: spectre_v1 mitigation: usercopy/swapgs barriers and __user pointer sanitization
  Type: spectre_v2 mitigation: Enhanced / Automatic IBRS; IBPB: conditional; STIBP: always-on;
    RSB filling; PBRSB-eIBRS: Not affected; BHI: Not affected
  Type: srbds status: Not affected
  Type: tsx_async_abort status: Not affected
Graphics:
  Device-1: NVIDIA GA104 [GeForce RTX 3070] vendor: ZOTAC driver: nvidia v: 535.216.03
    non-free: 530.xx+ status: current (as of 2023-03) arch: Ampere code: GAxxx process: TSMC n7 (7nm)
    built: 2020-22 pcie: gen: 4 speed: 16 GT/s lanes: 16 bus-ID: 01:00.0 chip-ID: 10de:2484
    class-ID: 0300
  Device-2: AMD Raphael vendor: Micro-Star MSI driver: amdgpu v: kernel arch: RDNA-2
    code: Navi-2x process: TSMC n7 (7nm) built: 2020-22 pcie: gen: 4 speed: 16 GT/s lanes: 16 ports:
    active: none empty: DP-1, DP-2, DP-3, HDMI-A-1, Writeback-1 bus-ID: 10:00.0 chip-ID: 1002:164e
    class-ID: 0300 temp: 39.0 C
  Display: x11 server: X.Org v: 1.21.1.7 with: Xwayland v: 22.1.9 compositor: kwin_x11 driver: X:
    loaded: amdgpu,nvidia unloaded: fbdev,modesetting,nouveau,vesa alternate: nv dri: radeonsi
    gpu: nvidia,amdgpu display-ID: :0 screens: 1
  Screen-1: 0 s-res: 1280x1024 s-dpi: 85 s-size: 382x302mm (15.04x11.89") s-diag: 487mm (19.17")
  Monitor-1: HDMI-0 res: 1280x1024 hz: 60 dpi: 86 size: 376x301mm (14.8x11.85")
    diag: 482mm (18.96") modes: N/A
  API: OpenGL v: 4.6.0 NVIDIA 535.216.03 renderer: NVIDIA GeForce RTX 3070/PCIe/SSE2
    direct-render: Yes
Audio:
  Device-1: NVIDIA GA104 High Definition Audio vendor: ZOTAC driver: snd_hda_intel v: kernel pcie:
    gen: 4 speed: 16 GT/s lanes: 16 bus-ID: 01:00.1 chip-ID: 10de:228b class-ID: 0403
  Device-2: AMD Rembrandt Radeon High Definition Audio vendor: Micro-Star MSI
    driver: snd_hda_intel v: kernel pcie: gen: 4 speed: 16 GT/s lanes: 16 bus-ID: 10:00.1
    chip-ID: 1002:1640 class-ID: 0403
  Device-3: AMD Family 17h/19h/1ah HD Audio vendor: Micro-Star MSI driver: snd_hda_intel
    v: kernel pcie: gen: 4 speed: 16 GT/s lanes: 16 bus-ID: 10:00.6 chip-ID: 1022:15e3 class-ID: 0403
  API: ALSA v: k6.14.2-1-liquorix-amd64 status: kernel-api tools: alsamixer,amixer
  Server-1: PipeWire v: 1.2.7 status: active with: 1: pipewire-pulse status: active
    2: wireplumber status: active 3: pipewire-alsa type: plugin 4: pw-jack type: plugin
    tools: pactl,pw-cat,pw-cli,wpctl
Network:
  Device-1: Realtek RTL8125 2.5GbE vendor: Micro-Star MSI driver: r8169 v: kernel pcie: gen: 2
    speed: 5 GT/s lanes: 1 port: e000 bus-ID: 0c:00.0 chip-ID: 10ec:8125 class-ID: 0200
  IF: eth0 state: up speed: 1000 Mbps duplex: full mac: <filter>
Drives:
  Local Storage: total: 476.94 GiB used: 270.88 GiB (56.8%)
  SMART Message: Unable to run smartctl. Root privileges required.
  ID-1: /dev/nvme0n1 maj-min: 259:0 vendor: Western Digital model: PC SN730 SDBPNTY-512G-1006
    size: 476.94 GiB block-size: physical: 512 B logical: 512 B speed: 31.6 Gb/s lanes: 4 type: SSD
    serial: <filter> rev: HPS2 temp: 37.9 C scheme: GPT
Partition:
  ID-1: / raw-size: 476.69 GiB size: 468.13 GiB (98.21%) used: 270.88 GiB (57.9%) fs: ext4
    dev: /dev/nvme0n1p2 maj-min: 259:2
  ID-2: /boot/efi raw-size: 256 MiB size: 252 MiB (98.46%) used: 274 KiB (0.1%) fs: vfat
    dev: /dev/nvme0n1p1 maj-min: 259:1
Swap:
  Kernel: swappiness: 15 (default 60) cache-pressure: 100 (default)
  ID-1: swap-1 type: file size: 53.16 GiB used: 0 KiB (0.0%) priority: -2 file: /swap/swap
Sensors:
  System Temperatures: cpu: 32.0 C mobo: N/A
  Fan Speeds (RPM): N/A
  GPU: device: nvidia screen: :0.0 temp: 44 C fan: 0% device: amdgpu temp: 39.0 C
Repos:
  Packages: pm: dpkg pkgs: 2768 libs: 1512 tools: apt,apt-get,aptitude,nala pm: rpm pkgs: 0
    pm: flatpak pkgs: 0
  No active apt repos in: /etc/apt/sources.list
  Active apt repos in: /etc/apt/sources.list.d/debian-stable-updates.list
    1: deb http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
  Active apt repos in: /etc/apt/sources.list.d/debian.list
    1: deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
    2: deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
  Active apt repos in: /etc/apt/sources.list.d/mx.list
    1: deb http://mxlinux.mirrors.uk2.net/packages/mx/repo/ bookworm main non-free
    2: deb http://mxlinux.mirrors.uk2.net/packages/mx/repo/ bookworm ahs
  Active apt repos in: /etc/apt/sources.list.d/mxpitemp.list
    1: deb http://mxlinux.mirrors.uk2.net/packages/mx/testrepo bookworm test
  Active apt repos in: /etc/apt/sources.list.d/vscodium.list
    1: deb [ signed-by=/usr/share/keyrings/vscodium-archive-keyring.gpg ] https://paulcarroty.gitlab.io/vscodium-deb-rpm-repo/debs vscodium main
Info:
  Processes: 350 Uptime: 4d 10h 42m wakeups: 11 Memory: 46.17 GiB used: 4.57 GiB (9.9%)
  Init: SysVinit v: 3.06 runlevel: 5 default: graphical tool: systemctl Compilers: gcc: 12.2.0
  alt: 11/12 Client: shell wrapper v: 5.2.15-release inxi: 3.3.26
Boot Mode: UEFI

Thanks for the info

[Eadwine Rose]

Removed coloring, please keep things readable and just use black.

You can post code on the forum like this:

[code]code output here[/code]

Thanks.

[fehlix]

apt updated today an got these messages should I be concerned:

You are booting with Secure Boot" disabled, and b/c you also have not prepared your own signing key to sign the dkms-modules and all the other kernel modules.
So nothing to be concerned, about this information given that the modules will not be signed:

Code: Select all

/usr/sbin/dkms.mx autoinstall --kernelver 6.14.2-1-liquorix-amd64
Sign command: /lib/modules/6.14.2-1-liquorix-amd64/build/scripts/sign-file
Binary /lib/modules/6.14.2-1-liquorix-amd64/build/scripts/sign-file not found, modules won't be signed

[Discostu]

You are booting with Secure Boot" disabled, and b/c you also have not prepared your own signing key to sign the dkms-modules and all the other kernel modules.

Sorry for asking from the sideline: Is this something that one should do? What are the advantages? How does it work?

[fehlix]

You are booting with Secure Boot" disabled, and b/c you also have not prepared your own signing key to sign the dkms-modules and all the other kernel modules.

Sorry for asking from the sideline: Is this something that one should do? What are the advantages? How does it work?

The liquorix kernsl are not signed by MX, so if anybody needs wants to boot with secureboot enabled,
he would need this to do. SecureBoot advantage? Hmm good question. Some say it offers more security. But other opinions exists.

[MXRobo]

deleted.

[Eadwine Rose]

When you have to say that you are not trying to hijack a thread, then don't. Usually that means you are hijacking a thread. Can you open your own topic please.

[MXRobo]

Yes, I will @Eadwine Rose, sorry.
Honestly, I'm not intentionally trying to skirt the rules, it just seems to go against my frugal grain, to 'waste' more space and create another topic - particularly for an insignificant question.
Also, I seem to see an extremely wide variation on what is and is not allowed; obviously based on upon topic relevancy, and very understandably who is posting; but yes I'll definitely start a new topic.
And obviously, the current topics spark new "?relevant?" questions.

Cheers @Eadwine Rose

[1nky]

hey Thanks for the info

You are correct I have not enabled SB and have not set up a signing key...
Just to sure where the warning says

This indicates that it should not be built. Skipping

It still builds the application packages and skips the BUILD EXCLUSIVE signing parts ?