Several hours of back and fourth between Copilot and Terminal it turned out the VirtualBox kernel modules where compressed with .zst which prevented them from getting signed with my MOK key. Once decompressed the signing process worked after several attempts. I do not know why but not all the signing processes worked each time but i got there in the end.
Copilot even came up with a script to automate the process in the event of an update once the problem was solved.
Saved to /etc/dkms/post_install.d/virtualbox-sign.sh and made executable
Code:
#!/bin/bash
# DKMS post-install hook for VirtualBox modules under Secure Boot
# Automatically decompresses, signs, deletes .zst, and refreshes modules
KERNEL_VERSION="$1"
MODULES_DIR="/lib/modules/${KERNEL_VERSION}/updates/dkms"
KEY="/root/secureboot/MOK.priv"
CERT="/root/secureboot/MOK.pem"
SIGN="/usr/src/linux-headers-${KERNEL_VERSION}/scripts/sign-file"
# Ensure zstd is available
command -v unzstd >/dev/null 2>&1 || exit 0
for mod in vboxdrv vboxnetflt vboxnetadp; do
FILE_ZST="${MODULES_DIR}/${mod}.ko.zst"
FILE_KO="${MODULES_DIR}/${mod}.ko"
# If compressed, decompress and remove the .zst
if [ -f "$FILE_ZST" ]; then
sudo unzstd "$FILE_ZST" -o "$FILE_KO"
sudo rm -f "$FILE_ZST"
fi
# If uncompressed exists, sign it
if [ -f "$FILE_KO" ]; then
sudo "$SIGN" sha256 "$KEY" "$CERT" "$FILE_KO"
fi
done
# Refresh module dependencies
sudo depmod -a "$KERNEL_VERSION"
# Optional logging
echo "VirtualBox modules signed for kernel $KERNEL_VERSION" >> /var/log/dkms_virtualbox_sign.log
Not being an expert in coding it seems to be doing what I want. I will find out if it works next time the Kernel updates.
Progress
The next problem
Code:
HM ring-0 init failed: VERR_NOT_AVAILABLE (VERR_NOT_AVAILABLE). Result Code: NS_ERROR_FAILURE (0x80004005) Component: ConsoleWrap Interface: IConsole {6ac83d89-6ee7-4e33-8ae6-b257b2e81be8}
For some reason VirtualBox was trying to us kvm. This was odd because when I first ever used VirtualBox on Linux I had to blacklist kvm and kvm_intel as it could not co-exist. Yet Copilot was telling me that they could.
So just as a test thought if it wants kvm I would give it all kvm that I blocked previously . I hashed out the kvm enteries in my blacklist.conf and sudo update-initramfs -u and rebooted.
Error cleared, more progress
New error
This was simpler as I have encured this error before, all that is needed is to add vboxusers to my user account
Code:
sudo usermod -aG vboxusers ravenlun
And after all that VirtualBox worked
I hope this post helps someone in the future!
Edit: Moved my MOK keys to "/root/secureboot/" from home folder
