Package: dkms
Version: 3.2.2-1
Severity: important
Tags: patch
Hello,
I prepared this report and patch with AI assistance.
Debian testing's dkms 3.2.2-1 installs modules unsigned when openssl is absent,
although autoinstall reports success.
The package declares openssl in no dependency field.
This prevents those modules from loading on systems that enforce module
signatures.
I reproduced this in a clean Debian testing amd64 container with
v4l2loopback-dkms 0.15.4-2 and linux-headers-amd64 7.2.12-1, targeting
7.2.12+deb14-amd64.
As root, with openssl initially absent:
apt-get update
apt-get -y --no-install-recommends install dkms v4l2loopback-dkms gcc
python3 xz-utils
apt-get -y --no-install-recommends install linux-headers-amd64
Both installs exit 0 and openssl remains absent.
The headers installation prints:
openssl not found, can't generate key and certificate.
Autoinstall on 7.2.12+deb14-amd64 succeeded for module(s) v4l2loopback.
For /lib/modules/7.2.12+deb14-amd64/updates/dkms/v4l2loopback.ko, modinfo -F
signer prints an empty line and the file has no module signature trailer.
I enabled deb-src for testing, ran apt-get source dkms=3.2.2-1 and apt-get -y
--no-install-recommends build-dep dkms=3.2.2-1, applied the patch below and
built with dpkg-buildpackage -b -us -uc -j4.
The build exited 0 and openssl was still absent.
I kept the version unchanged for this local test, so the only source change is
the added dependency.
In the same container, installing the resulting package with apt-get -y
--allow-downgrades --no-install-recommends install --reinstall
./dkms_3.2.2-1_all.deb automatically installed openssl 3.6.5-1 and removed
nothing.
APT required --allow-downgrades for this different local archive with the same
version.
dkms was the only installed package with a direct Depends on openssl, and
openssl was marked automatically installed.
The old unsigned module remains unchanged until rebuilt:
dkms build --force v4l2loopback/0.15.4 -k 7.2.12+deb14-amd64
dkms install --force v4l2loopback/0.15.4 -k 7.2.12+deb14-amd64
Both commands exit 0.
The installed module now has signer "DKMS module signing key", and its sig_key
matches the serial of /var/lib/dkms/mok.pub.
The extracted PKCS#7 signature verifies against that certificate with openssl
cms -verify -binary -nointern -noverify, returning 0 and "CMS Verification
successful".
Changing one byte of the signed content or substituting an unrelated
certificate makes verification return 4.
This verifies the module signature, not certificate enrollment or a Secure Boot
boot; no module was loaded in this container.
The kernel in reportbug's system information is the shared host kernel, not the
Debian module target above.
Please add openssl to Depends so the default signing path also works when
installing without recommendations.
Debian Policy 7.2 bases dependency strength on the importance of the component;
module signing is needed for usable modules when signature enforcement is
enabled.
https://www.debian.org/doc/debian-policy/ch-relationships.html#binary-dependencies-depends-recommends-suggests-enhances-pre-depends
The patch against Debian's dkms 3.2.2-1 is:
--- a/debian/control
+++ b/debian/control
@@ -22,6 +22,7 @@
dpkg-dev,
make | build-essential,
patch,
+ openssl,
Recommends:
gcc | c-compiler,
fakeroot,
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 7.3.1-stereo3d14 (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=C, LC_CTYPE=C (charmap=UTF-8) (ignored: LC_ALL set to C.UTF-8),
LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: unable to detect
Versions of packages dkms depends on:
ii build-essential 12.12
ii dpkg-dev 1.23.11
ii kmod 34.2-2+b2
ii make 4.4.1-3
ii patch 2.8.1-1
Versions of packages dkms recommends:
pn fakeroot <none>
ii gcc [c-compiler] 4:16.1.0-3
ii gcc-16 [c-compiler] 16.2.0-3
pn sudo <none>
Versions of packages dkms suggests:
pn e2fsprogs <none>
pn menu <none>
-- no debconf information
