Sign kernel modules for secure boot

sign_modules.py

#!/usr/bin/env python
from __future__ import print_function
import io
import glob
import os
import subprocess

os.chdir(os.path.dirname(__file__))

priv_file = 'MOK.priv'
der_file = 'MOK.der'

osrelease = io.open('/proc/sys/kernel/osrelease').read().strip()

sign_file = '/usr/src/linux-headers-{}/scripts/sign-file'.format(osrelease)
assert(os.path.exists(sign_file))

glob_pattern = '/lib/modules/{}/misc/*.ko'.format(osrelease)
for file_path in glob.iglob(glob_pattern):
    print(file_path)
    subprocess.check_call(
        [sign_file, 'sha256', priv_file, der_file, file_path]
    )