[michaelb990]

Issue number:

N/A

Description of changes:

Sign every module built by kernel-6.18, kmod-6.18-efa and kmod-6.18-nvidia-r580 with the kit module-signing key from bottlerocket-os/twoliter#764.

Draft: this depends on bottlerocket-os/twoliter#764, which mounts the key and defines %_cross_module_signing_key, and on a Bottlerocket SDK release with bottlerocket-os/bottlerocket-sdk#398, which adds the sign-kernel-modules buildroot policy. The first commit builds Twoliter from the #764 branch so CI can run, and will be replaced with the Twoliter release; the SDK pin moves to the SDK release.

• All three packages set module-signing = true, so Twoliter mounts one key per kit build for these three package builds only.
• kernel-6.18 passes the key, %{_cross_module_signing_key} (defined by Twoliter), to every make as CONFIG_MODULE_SIG_KEY, so Kbuild signs the in-tree and Neuron modules with it and builds its certificate in as the only built-in key, instead of generating a key of its own.
• A new kernel-6.18-module-signature-enforcement subpackage ships the certificate as /usr/share/bottlerocket/module-signing/kit-cert.pem and a boot config snippet that sets module.sig_enforce=1 and lockdown=integrity. Nothing pulls it in; variants that want enforcement add it to included-packages.
• The kmod specs don't change beyond the opt-in: the SDK's sign-kernel-modules buildroot policy signs the modules they install (efa.ko; the open GPU modules, the GRID modules built from the GRID driver's kernel-open tree, and gdrdrv). The proprietary driver ships as unlinked objects and is not signed.
• The r580 open-driver check now covers H100, H200, B200 and B300 on x86_64 and GB200 and GB300 on aarch64.

Other variants are unaffected beyond the change of signing key: the final kernel .config and command line are unchanged.

Commits:

1. DO NOT MERGE: build Twoliter from the module-signing branch
2. kernel-6.18, kmods: sign modules with the kit module-signing key
3. kmod-6.18-nvidia-r580: check more GPUs keep the open driver

Testing done:

• Built the x86_64 kernel kit in one Twoliter run, with an SDK carrying macros: add sign-kernel-modules buildroot policy bottlerocket-sdk#398: all 870 modules in the three packages verify against the kit certificate (in-tree, Neuron, efa.ko, five open GPU, five GRID, gdrdrv).
• Booted an aws-mantle-1 x86_64 image built from that kit, with the subpackage added and the two switches in kernel-parameters (the snippet needs Remove kernel cmdline hardcoding and enable PCR calculations for UKI twoliter#745 to reach the UKI command line), on m7i.large with Secure Boot:
  • module.sig_enforce is Y, lockdown is [integrity];
  • .builtin_trusted_keys holds only the kit key;
  • insmod of dummy.ko without its signature, and signed by an untrusted key, are both rejected ("Key was rejected by service"); the kit-signed dummy.ko loads; taint stays 0.
• aarch64 has not been built yet.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.