I recently had to replace my motherboard on one of my PCs with a Nvidia GPU, which meant I had to figure out how to get Secure Boot working again with out-of-tree Nvidia kernel modules. Maintaining self-signed kernel modules is automated and zero-effort with dkms, but the initial setup takes a bit of legwork, so I figured I may as well document it for future reference.

This blog post specifically covers the use case of using a signed, standard distribution kernel provided by Debian/Ubuntu and using shim-signed to provision self-signed out of tree kernel modules that are registered with …