I'm having a little trouble signing my zfs module in Fedora 27 using UEFI/Secure Boot and I hoped someone here might be able to help.
As a quick explanation for how I would normally do this, I sign the VirtualBox module using keys I have already generated and registered with efibootmgr, with the following command:
# /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 ./key.priv ./key.der $(modinfo -n vboxdrv)
It works fine because vboxdrv exists as an ordinary kernel module, and I do the same thing successfully for every kernel update, and the process is generic enough that I should be able to do the same thing with zfs. But attempting to do so fails. Checking
# modinfo -n zfs, I see that the zfs kernel module appears to exist as a compressed file -
/lib/modules/4.15.17-300.fc27.x86_64/extra/zfs.ko.xz (and that is the correct current kernel version).
To see if maybe there's another module that exists elswhere, I run
# find / -name zfs.ko which returns nothing, so this .xz file is the only zfs module available. Fine, so I run #
xz --decompress zfs.ko.xz. This tells me that the data is corrupt (the xz utility is what returns this error, suggesting that it isn't an xz-compressed file, or at least is modified in some way or otherwise can't be handled by the builtin xz).
# modinfo zfs just returns the path to zfs.ko.xz and a modinfo error.
So I'm at a loss at this point. Disabling secure boot is not really an option I want to consider. How am I supposed to sign a compressed module if I can't decompress the file first? Or is it already signed with a key available for me somewhere to download that I'm supposed to register?