[Retr0astic]

Problem

Current nixpkgs (since NixOS/nixpkgs@6bd7526744, "aggregateModules: merge certificates from external modules") signs kernel modules with kmodigest and expects a <module>.ko.cer certificate next to every external module when NixOS assembles the module tree. nix/vds-module.nix copied vds_hcd.ko into place with install, so the module was never signed and no certificate exists. Any NixOS system with services.opends5.enable = true on that nixpkgs fails to build:

cat: extra/vds_hcd.ko.cer: No such file or directory
error: Cannot build '…-linux-zen-7.2.11-modules.drv'.
       Reason: builder failed with exit code 123.

This is the same breakage as NixOS/nixpkgs#575192 (zenpower, acpi_call, yt6801). The fix there for in-tree packages is the same as here (NixOS/nixpkgs#577453).

Fix

• Pass the kernel's commonMakeFlags to the build. On new nixpkgs these carry the cmd_sign=kmodigest … override.
• Install with Kbuild's make modules_install instead of copying the .ko, so the module goes through that signing step and vds_hcd.ko.cer is written next to it.
• DEPMOD=true keeps a stray module index out of $out (NixOS builds one for the whole tree).
• Kernels from older nixpkgs have no commonMakeFlags, so or [ ] keeps them building as before.

Side effect: Kbuild installs the module compressed (vds_hcd.ko.xz), like every other module in the tree. modprobe handles that transparently.

Testing

Built vds-module.nix and aggregateModules [ kernel.modules vds ] (the step that fails) against:

nixpkgs	kernel	result
02c087f (2026-10-20)	linux_zen 7.2.11	builds; module SIGNed, extra/vds_hcd.ko.cer present, listed in modules.dep, PKCS#7 signature same as in-tree modules
e7a3ca8 (this flake's lock)	linux_zen 7.1.2	builds; module listed in modules.dep

Not yet booted on hardware.

nix/vds-hcd.nix has the same hand-copy install but nothing references it, so I left it alone.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DcLhngVhW5BGLmCdt5Uvbd