VyOS image build scripts (mirror of https://github.com/vyos/vyos-build.git) https://git.amelek.net/vyos/vyos-build.git/atom?h=sever-sever-patch-1 2026-07-08T18:45:13+00:00 2026-07-08T18:45:13+00:00 Christian Breunig christian@breunig.cc 2026-07-08T18:45:13+00:00 urn:sha1:21c7e66112d3ec360a9902037d086fdb15e4ebeb After signing the Linux Kernel modules with the ephemeral key, proceed by compressing the Kernel modules with xz to reduce the final ISO image size. Initial tests have shown a size reduction by 60MiB. 2024-09-25T18:24:21+00:00 Christian Breunig christian@breunig.cc 2024-09-25T18:24:21+00:00 urn:sha1:d235b31a095f9b8fdb2d5c231935c8b4b4c3da6c The shim review board (which is the secure boot base loader) recommends using ephemeral keys when signing the Linux Kernel. This commit enables the Kernel build system to generate a one-time ephemeral key that is used to: * sign all build-in Kernel modules * sign all other out-of-tree Kernel modules The key lives in /tmp and is destroyed after the build container exits and is named: "VyOS build time autogenerated kernel key". In addition the Kernel now uses CONFIG_MODULE_SIG_FORCE. This now makes it unable to load any Kernel Module to the image that is NOT signed by the ephemeral key.