Over the Thanksgiving holiday weekend I finally had some spare time to catch up and ensure the Debian packages I maintain are in good shape. I figured I'd blog about it too, in an effort to get back into blogging and sharing my thoughts a bit more frequently.

I recently had to replace my motherboard on one of my PCs with a Nvidia GPU, which meant I had to figure out how to get Secure Boot working again with out-of-tree Nvidia kernel modules. Maintaining self-signed kernel modules is automated and zero-effort with dkms, but the initial setup takes a bit of legwork, so I figured I may as well document it for future reference.

This blog post specifically covers the use case of using a signed, standard distribution kernel provided by Debian/Ubuntu and using shim-signed to provision self-signed out of tree kernel modules that are registered with …