From 7f39f135e9cd56f0fa0cf9d92a7862e3edee62eb Mon Sep 17 00:00:00 2001
From: retr0astic <sreejiraj2399@gmail.com>
Date: Fri, 23 Oct 2026 13:08:13 +0400
Subject: [PATCH] Install vds_hcd through Kbuild so nixpkgs can sign it

Recent nixpkgs signs kernel modules with kmodigest and, when NixOS
assembles the module tree, merges a .ko.cer certificate for every
external module. vds-module.nix copied vds_hcd.ko into place by hand, so
no certificate was produced and every NixOS system with OpenDS5 enabled
failed to build:

    cat: extra/vds_hcd.ko.cer: No such file or directory

Pass the kernel's commonMakeFlags (which carry the cmd_sign override)
and install with `make modules_install`, so the module is signed and its
certificate written next to it. DEPMOD=true keeps a stray module index
out of the output. Kernels from older nixpkgs have no commonMakeFlags
and build as before.

Tested against nixpkgs 02c087f (linux_zen 7.2.11) and the pinned
e7a3ca8 (linux_zen 7.1.2); both build the full module tree.

See NixOS/nixpkgs#575192.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DcLhngVhW5BGLmCdt5Uvbd
---
 nix/vds-module.nix | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/nix/vds-module.nix b/nix/vds-module.nix
index 98b9ae4..38a29ad 100644
--- a/nix/vds-module.nix
+++ b/nix/vds-module.nix
@@ -7,6 +7,16 @@
 , version
 }:
 
+let
+  kdir = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+
+  # The kernel's own make flags. Since nixpkgs started signing modules with
+  # kmodigest, these carry the `cmd_sign` override that writes the
+  # vds_hcd.ko.cer certificate NixOS needs when it assembles the module
+  # tree; without it that build fails (NixOS/nixpkgs#575192). Older kernels
+  # do not have the attribute and need nothing extra.
+  kernelFlags = kernel.commonMakeFlags or [ ];
+in
 stdenv.mkDerivation {
   pname = "vds_hcd";
   inherit version;
@@ -17,17 +27,26 @@ stdenv.mkDerivation {
   hardeningDisable = [ "pic" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernelFlags ++ [
     "-C" "module"
     "KERNELRELEASE=${kernel.modDirVersion}"
-    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "KDIR=${kdir}"
     "VDS_VERSION=${version}"
   ];
 
+  # Install through Kbuild rather than copying the .ko, so the module goes
+  # through the kernel's signing step. DEPMOD=true keeps it from writing a
+  # module index into $out; NixOS builds one for the whole tree.
   installPhase = ''
     runHook preInstall
-    install -D module/vds_hcd.ko \
-      $out/lib/modules/${kernel.modDirVersion}/extra/vds_hcd.ko
+    make -C ${kdir} M="$PWD/module" \
+      ${lib.escapeShellArgs kernelFlags} \
+      KERNELRELEASE=${kernel.modDirVersion} \
+      VDS_VERSION=${version} \
+      INSTALL_MOD_PATH="$out" \
+      INSTALL_MOD_DIR=extra \
+      DEPMOD=true \
+      modules_install
     runHook postInstall
   '';