Kernel: T5641: enable module compression to save disk space

After signing the Linux Kernel modules with the ephemeral key, proceed
by compressing the Kernel modules with xz to reduce the final ISO image
size.

Initial tests have shown a size reduction by 60MiB.

5 files changed, 94 insertions, 5 deletions

diff --git a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh
index 69e2cf30..aa1f8d12 100755
--- a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh
+++ b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh
@@ -58,8 +58,12 @@ cmake -DBUILD_IPOE_DRIVER=TRUE \
     -DCPACK_TYPE=Debian12 ..
 CPATH="${VPP_INCLUDE_PATH}" LIBRARY_PATH="${VPP_LIBRARY_PATH}" make
 
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh .
+# Sign generated Kernel modules. Keep the uncompressed .ko next to the
+# resulting .ko.xz: cpack's DEB packaging re-runs "make all" as part of
+# its install step, and if the .ko CMake tracks as a build output were
+# removed by compression, it would be silently rebuilt unsigned before
+# being packaged.
+${CWD}/sign-modules.sh . --keep
 
 cpack -G DEB
 
diff --git a/scripts/package-build/linux-kernel/build-ipt-netflow.sh b/scripts/package-build/linux-kernel/build-ipt-netflow.sh
index bae4051b..2c7554fa 100755
--- a/scripts/package-build/linux-kernel/build-ipt-netflow.sh
+++ b/scripts/package-build/linux-kernel/build-ipt-netflow.sh
@@ -72,6 +72,6 @@ fpm --input-type dir --output-type deb --name vyos-ipt-netflow \
     --description "ipt_NETFLOW module" \
     --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
     --license "GPL2" -C ${IPT_NETFLOW_SRC}/tmp --after-install ${DEBIAN_POSTINST} \
-    ipt_NETFLOW.ko=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko \
+    ipt_NETFLOW.ko.xz=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko.xz \
     libipt_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libipt_NETFLOW.so \
     libip6t_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libip6t_NETFLOW.so
diff --git a/scripts/package-build/linux-kernel/config/02-module-signing.config b/scripts/package-build/linux-kernel/config/02-module-signing.config
index d981ea63..3b98bc1e 100644
--- a/scripts/package-build/linux-kernel/config/02-module-signing.config
+++ b/scripts/package-build/linux-kernel/config/02-module-signing.config
@@ -22,3 +22,9 @@ CONFIG_SYSTEM_TRUSTED_KEYRING=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 CONFIG_MODULE_SIG_KEY_TYPE_RSA=y
 # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set
+CONFIG_MODULE_COMPRESS=y
+# CONFIG_MODULE_COMPRESS_GZIP is not set
+CONFIG_MODULE_COMPRESS_XZ=y
+# CONFIG_MODULE_COMPRESS_ZSTD is not set
+CONFIG_MODULE_COMPRESS_ALL=y
+CONFIG_MODULE_DECOMPRESS=y
diff --git a/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch b/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch
new file mode 100644
index 00000000..d69ef038
--- /dev/null
+++ b/scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch
@@ -0,0 +1,66 @@
+From: Christian Breunig <christian@vyos.io>
+Date: Sun, 5 Jul 2026 00:00:00 +0200
+Subject: [PATCH] cmake: package signed/compressed kernel modules
+
+sign-modules.sh signs the built ipoe/vlan_mon/pptp kernel modules and,
+if the target kernel's .config enables CONFIG_MODULE_COMPRESS_XZ,
+compresses them to .ko.xz before cpack packages the Debian archive.
+The Debian packaging rules installed the drivers by their exact
+pre-sign build path (*.ko) unconditionally, so a compressed build
+never actually shipped the compressed module. Mirror sign-modules.sh's
+own .config check to pick the extension that actually ends up on disk.
+
+---
+ cmake/debian/debian.cmake | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/cmake/debian/debian.cmake b/cmake/debian/debian.cmake
+index 8db274a..64b8f7d 100644
+--- a/cmake/debian/debian.cmake
++++ b/cmake/debian/debian.cmake
+@@ -9,6 +9,18 @@ if (NOT DEFINED MODULES_KDIR)
+ 	)
+ endif()
+
++# sign-modules.sh signs the built .ko files and, if the target kernel's
++# .config has module compression enabled, xz-compresses them in place.
++# Mirror that check here so we install whichever artifact actually ends
++# up on disk.
++SET(KMOD_EXT ".ko")
++IF (DEFINED KDIR AND EXISTS "${KDIR}/.config")
++	FILE(STRINGS "${KDIR}/.config" _ACCEL_PPP_KMOD_COMPRESS_XZ REGEX "^CONFIG_MODULE_COMPRESS_XZ=y$")
++	IF (_ACCEL_PPP_KMOD_COMPRESS_XZ)
++		SET(KMOD_EXT ".ko.xz")
++	ENDIF ()
++ENDIF ()
++
+ if (BUILD_PPTP_DRIVER)
+ 	if (BUILD_DRIVER_ONLY)
+ 		SET(CPACK_PACKAGE_VERSION_MAJOR "0")
+@@ -21,7 +33,7 @@ if (BUILD_PPTP_DRIVER)
+ 		SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst")
+ 	endif ()
+ 	#INSTALL(DIRECTORY lib/modules/${DEBIAN_KDIR}/extra)
+-	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra)
++	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra)
+ 	#SET(CPACK_DEBIAN_PACKAGE_DEPENDS "linux-image (= ${LINUX_IMAGE})")
+ endif (BUILD_PPTP_DRIVER)
+
+@@ -33,7 +45,7 @@ if (BUILD_IPOE_DRIVER)
+ 		SET(CPACK_DEBIAN_PACKAGE_DEPENDS "")
+ 		SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst")
+ 	endif ()
+-	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra)
++	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra)
+ endif (BUILD_IPOE_DRIVER)
+
+ if (BUILD_VLAN_MON_DRIVER)
+@@ -44,7 +56,7 @@ if (BUILD_VLAN_MON_DRIVER)
+ 		SET(CPACK_DEBIAN_PACKAGE_DEPENDS "")
+ 		SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst")
+ 	endif ()
+-	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra)
++	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra)
+ endif (BUILD_VLAN_MON_DRIVER)
+
+ if (NOT BUILD_DRIVER_ONLY)
diff --git a/scripts/package-build/linux-kernel/sign-modules.sh b/scripts/package-build/linux-kernel/sign-modules.sh
index cfb368eb..1fb82165 100755
--- a/scripts/package-build/linux-kernel/sign-modules.sh
+++ b/scripts/package-build/linux-kernel/sign-modules.sh
@@ -1,15 +1,28 @@
-#!/bin/sh
+#!/bin/sh -x
 
 BASE_DIR=$(dirname $0)
 MODULE_DIR=$1
+# Pass "--keep" as $2 to retain the uncompressed, signed .ko next to the
+# .ko.xz it produces. Needed by callers whose build system tracks the
+# uncompressed .ko as a build output (e.g. CMake custom commands) and
+# would otherwise consider it missing and regenerate an unsigned copy.
+KEEP_UNCOMPRESSED=$2
 . ${BASE_DIR}/kernel-vars
 
 SIGN_FILE="${KERNEL_DIR}/scripts/sign-file"
+CONFIG_FILE="${KERNEL_DIR}/.config"
 
 if [ -f ${EPHEMERAL_KEY} ] && [ -f ${EPHEMERAL_CERT} ]; then
     find ${MODULE_DIR} -type f -name \*.ko | while read MODULE; do
       echo "I: Signing ${MODULE} ..."
       ${SIGN_FILE} sha512 ${EPHEMERAL_KEY} ${EPHEMERAL_CERT} ${MODULE}
+      if [ -f "$CONFIG_FILE" ] && grep -qx "CONFIG_MODULE_COMPRESS_XZ=y" "$CONFIG_FILE"; then
+          if [ "${KEEP_UNCOMPRESSED}" = "--keep" ]; then
+              xz --compress --keep ${MODULE}
+          else
+              xz --compress ${MODULE}
+          fi
+      fi
     done
+    find ${MODULE_DIR}
 fi
-