sign-vbox.sh

#!/bin/sh

readonly hash_algo='sha256'
readonly key='MOK.priv'
readonly x509='MOK.der'

readonly name="$(basename $0)"
readonly esc='\\e'
readonly reset="${esc}[0m"
readonly fullver=$(uname -r)
readonly majorminor="$(echo $fullver | cut -d '.' -f1,2)"

green() { local string="${1}"; echo "${esc}[32m${string}${reset}"; }
blue() { local string="${1}"; echo "${esc}[34m${string}${reset}"; }
log() { local string="${1}"; echo "[$(blue $name)] ${string}"; }

# The exact location of `sign-file` might vary depending on your platform.
# This is for Ubuntu
alias sign-file="/usr/src/linux-headers-$(uname -r)/scripts/sign-file"

[ -z "${KBUILD_SIGN_PIN}" ] && read -p "Passphrase for ${key}: " KBUILD_SIGN_PIN
export KBUILD_SIGN_PIN

# In Debian, modinfo is not in the PATH even for root users. In other 
# distributions it may not be located at /sbin
for module in $(dirname $(/sbin/modinfo -n vboxdrv))/*.ko; do
  log "Signing $(green ${module})..."
  sign-file "${hash_algo}" "${key}" "${x509}" "${module}"
done