feat(arch): streamline signed driver packaging

Make Arch packages install the virtual display driver automatically, launch one-time signing authorization only when kernel enforcement requires it, and keep normal Arch and CachyOS installs confirmation-only.

Validate real direct and DKMS signing in CI, normalize prerelease package versions, and document Linux 7.1 compatibility and deployment behavior.

Generated with [Codex](https://openai.com/codex/)
Model: GPT 5.6-Sol X-High

Author: Nonary

.github/workflows/ci-archlinux.yml

@@ -62,8 +62,12 @@ jobs:
             base-devel \
             cmake \
             cuda \
+            dkms \
             git \
-            namcap
+            kmod \
+            linux-headers \
+            namcap \
+            openssl
           pacman -Scc --noconfirm
 
       - name: Checkout
@@ -73,6 +77,66 @@ jobs:
           fetch-depth: 1
           submodules: recursive
 
+      - name: Compile Vibeshine DRM against Arch kernel
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          mapfile -t kernel_build_dirs < <(
+            find /usr/lib/modules -mindepth 2 -maxdepth 2 -type d -name build -print | sort
+          )
+          if (( ${#kernel_build_dirs[@]} != 1 )); then
+            echo "::error::Expected exactly one Arch kernel header tree, found ${#kernel_build_dirs[@]}."
+            printf '%s\n' "${kernel_build_dirs[@]}" >&2
+            exit 1
+          fi
+
+          kernel_release="$(basename "$(dirname "${kernel_build_dirs[0]}")")"
+          module_build_dir="${RUNNER_TEMP}/vibeshine-drm-${kernel_release}"
+          cp -a third-party/libvirtualdisplay/linux/vibeshine-drm "${module_build_dir}"
+          MAKEFLAGS="-j$(nproc)" \
+            "${module_build_dir}/build-module" "${kernel_release}" "${module_build_dir}"
+          test -s "${module_build_dir}/vibeshine_drm.ko"
+
+          signing_key="${RUNNER_TEMP}/vibeshine-drm-mok.key"
+          signing_certificate="${RUNNER_TEMP}/vibeshine-drm-mok.pub"
+          openssl req -new -x509 -nodes -days 1 \
+            -subj '/CN=Vibeshine CI module signing key/' \
+            -newkey rsa:2048 -keyout "${signing_key}" \
+            -addext 'extendedKeyUsage=codeSigning' \
+            -outform DER -out "${signing_certificate}" >/dev/null 2>&1
+          "${kernel_build_dirs[0]}/scripts/sign-file" sha256 \
+            "${signing_key}" "${signing_certificate}" "${module_build_dir}/vibeshine_drm.ko"
+
+          certificate_serial="$(openssl x509 -inform DER -in "${signing_certificate}" -noout -serial)"
+          certificate_serial="${certificate_serial#serial=}"
+          module_sig_key="$(modinfo -F sig_key "${module_build_dir}/vibeshine_drm.ko")"
+          module_sig_key="${module_sig_key//:/}"
+          [[ "${module_sig_key^^}" == "${certificate_serial^^}" ]]
+          [[ "$(modinfo -F signer "${module_build_dir}/vibeshine_drm.ko")" == \
+             'Vibeshine CI module signing key' ]]
+
+          dkms_ci_version=0.0.1
+          dkms_source="/usr/src/vibeshine-drm-${dkms_ci_version}"
+          cp -a third-party/libvirtualdisplay/linux/vibeshine-drm "${dkms_source}"
+          sed "s/@PROJECT_VERSION_NUMERIC@/${dkms_ci_version}/g" \
+            "${dkms_source}/dkms.conf.in" >"${dkms_source}/dkms.conf"
+          printf 'try_sign_modules=true\n' >/etc/dkms/framework.conf.d/vibeshine-ci.conf
+          dkms add -m vibeshine-drm -v "${dkms_ci_version}"
+          MAKEFLAGS="-j$(nproc)" dkms build \
+            -m vibeshine-drm -v "${dkms_ci_version}" -k "${kernel_release}"
+          dkms install -m vibeshine-drm -v "${dkms_ci_version}" -k "${kernel_release}"
+
+          dkms_module="$(modinfo -k "${kernel_release}" -n vibeshine_drm)"
+          dkms_certificate_serial="$(openssl x509 -inform DER \
+            -in /var/lib/dkms/mok.pub -noout -serial)"
+          dkms_certificate_serial="${dkms_certificate_serial#serial=}"
+          dkms_sig_key="$(modinfo -F sig_key "${dkms_module}")"
+          dkms_sig_key="${dkms_sig_key//:/}"
+          [[ -n "$(modinfo -F signer "${dkms_module}")" ]]
+          [[ "${dkms_sig_key^^}" == "${dkms_certificate_serial^^}" ]]
+          dkms remove -m vibeshine-drm -v "${dkms_ci_version}" --all
+
       - name: Fix workspace permissions
         shell: bash
         run: |
@@ -163,10 +227,13 @@ jobs:
           package_info="$(bsdtar -xOf "${package}" .PKGINFO)"
           package_files="$(bsdtar -tf "${package}")"
           grep -qx 'depend = dkms' <<< "${package_info}"
-          grep -qx 'depend = mokutil' <<< "${package_info}"
+          grep -qx 'depend = mokutil>=0.7.2' <<< "${package_info}"
           grep -qx 'usr/libexec/vibeshine/vibeshine-drm-install' <<< "${package_files}"
           grep -qx 'usr/src/vibeshine-drm-[^/]*/dkms.conf' <<< "${package_files}"
           bsdtar -xOf "${package}" usr/libexec/vibeshine/vibeshine-drm-install | bash -n
+          package_install_script="$(bsdtar -xOf "${package}" .INSTALL)"
+          bash -n <<< "${package_install_script}"
+          grep -Fq 'vibeshine-drm-install install-package' <<< "${package_install_script}"
 
       - name: Copy Artifacts
         shell: bash

cmake/prep/special_package_configuration.cmake

@@ -73,6 +73,11 @@ elseif(UNIX)
 
     # configure the arch linux pkgbuild
     if(${SUNSHINE_CONFIGURE_PKGBUILD})
+        # Arch forbids hyphens in pkgver. Removing the SemVer prerelease
+        # separator also keeps e.g. 1.19.0beta.4 ordered below 1.19.0.
+        set(SUNSHINE_ARCH_PKGVER "${PROJECT_VERSION_FULL}")
+        string(REPLACE "-" "" SUNSHINE_ARCH_PKGVER "${SUNSHINE_ARCH_PKGVER}")
+        string(REPLACE "+" "." SUNSHINE_ARCH_PKGVER "${SUNSHINE_ARCH_PKGVER}")
         configure_file(packaging/linux/Arch/PKGBUILD PKGBUILD @ONLY)
         configure_file(packaging/linux/Arch/sunshine.install sunshine.install @ONLY)
     endif()

docs/configuration.md

@@ -1226,7 +1226,7 @@ editing the `conf` file in a text editor. Use the examples as reference.
             Replacing the module file does not replace a module already loaded by the compositor.
             Compare <code>modinfo -F version vibeshine_drm</code> with
             <code>cat /sys/module/vibeshine_drm/version</code> and reboot before testing when they differ.
-            The module targets Linux 7.2 or newer and exposes four independent virtual connectors
+            The module supports Linux 7.1 or newer and exposes four independent virtual connectors
             with a deterministic HDR10 EDID, BT.2020/PQ metadata, 8-16 bits per component, and
             10-bit RGB plane formats. Vibeshine enables one only for a stream, applies the requested
             mode, layout, and HDR state through KScreen, captures that exact connector, and restores
@@ -1239,14 +1239,16 @@ editing the `conf` file in a text editor. Use the examples as reference.
             fixed-rate KMS polling. KWin ScreenCast remains the recommended compositor capture path for SDR.
             <br><br>
             If the custom module cannot be built or loaded (including on older kernels or when
-            Secure Boot rejects an unsigned module), managed virtual displays remain unavailable.
+            the kernel rejects an untrusted module signature), managed virtual displays remain unavailable.
             Vibeshine deliberately does not fall back to CPU-backed stock <code>vkms</code> scanout.
             Arch Linux and CachyOS packages use DKMS to sign future rebuilds with a persistent local
-            key. When Secure Boot is enabled through shim, enroll that key once with
-            <code>sudo /usr/libexec/vibeshine/vibeshine-drm-install enroll-key</code>, reboot into the
-            MOK manager, and verify it afterward with
-            <code>/usr/libexec/vibeshine/vibeshine-drm-install signing-status</code>. Install the
-            matching kernel headers before retrying a failed module build.
+            key and verify the embedded signer before accepting the module. Stock Arch and CachyOS
+            kernels need no separate signing step: accepting the normal package-install confirmation
+            is enough, including with Secure Boot through Limine or systemd-boot. Only a custom kernel
+            that enforces trusted module signatures requires shim. The package installation detects
+            this and launches the one-time signing-key authorization prompt automatically; reboot and
+            approve the pending firmware confirmations once. Future updates remain automatic. Install
+            the matching kernel headers before retrying a failed module build.
         </td>
     </tr>
 </table>
@@ -1491,7 +1493,7 @@ Terminate request. The original game client is unaffected. The default is
         <td>Description</td>
         <td colspan="2">
             Perform additional HDR configuration for the display device.
-            @note{On Linux 7.2 or newer, the managed <code>vibeshine_drm</code> output advertises HDR10 and 10-bit formats. Managed display creation fails if that driver is unavailable rather than using CPU-backed stock VKMS.}
+            @note{On Linux 7.1 or newer, the managed <code>vibeshine_drm</code> output advertises HDR10 and 10-bit formats. Managed display creation fails if that driver is unavailable rather than using CPU-backed stock VKMS.}
         </td>
     </tr>
     <tr>

docs/getting_started.md

@@ -653,7 +653,7 @@ Additional information:
     not support HDR.
   - You will need a desktop environment with a compositor that supports HDR rendering, such as Gamescope or KDE Plasma 6.
   - Native Vibeshine installations can provide private HDR10 virtual outputs through the
-    `vibeshine_drm` module. It requires Linux 7.2 or newer and matching kernel headers. Its EDID
+    `vibeshine_drm` module. It requires Linux 7.1 or newer and matching kernel headers. Its EDID
     advertises BT.2020, PQ, and HDR static metadata, while its connector and planes support 10-bit output.
     The driver notifies direct KMS capture when a presentation completes, so sparse changes are captured
     immediately and bursts are coalesced to the stream's requested maximum frame rate. Older module
@@ -682,19 +682,16 @@ Additional information:
 
   On Arch Linux and CachyOS, install the matching headers for every kernel you boot (for example,
   `linux-headers` or `linux-cachyos-headers`). The native package uses DKMS and signs rebuilt
-  modules automatically. A Secure Boot system using shim needs one additional enrollment:
-
-  ```bash
-  sudo /usr/libexec/vibeshine/vibeshine-drm-install enroll-key
-  # Reboot, select "Enroll MOK", and enter the temporary password from the command above.
-  /usr/libexec/vibeshine/vibeshine-drm-install signing-status
-  modinfo -F signer vibeshine_drm
-  ```
-
-  This enrollment survives normal kernel and Vibeshine updates; DKMS continues using the same
-  root-only signing key. The helper refuses to schedule MOK enrollment unless the current boot
-  passed through shim, because direct Limine and systemd-boot paths do not make MOK keys available
-  to the Linux kernel.
+  modules automatically and verifies the signer embedded in every installed module. On stock Arch
+  and CachyOS kernels this all happens during package installation: accept pacman's normal install
+  confirmation and no separate signing or enrollment command is required, including when Secure
+  Boot uses a direct Limine or systemd-boot chain.
+
+  Only a custom kernel configured to enforce trusted module signatures needs additional
+  authorization. When that is detected, the package installation launches the one-time signing-key
+  confirmation automatically. After confirming it, reboot and approve the pending firmware
+  confirmations once; future kernel and Vibeshine updates remain automatic. If a noninteractive
+  package frontend cannot display the prompt, retry the package installation from a terminal.
 
   @seealso{[Arch wiki on HDR Support for Linux](https://wiki.archlinux.org/title/HDR_monitor_support) and
   [Reddit Guide for HDR Support for AMD GPUs](https://www.reddit.com/r/linux_gaming/comments/10m2gyx/guide_alpha_test_hdr_on_linux)}

docs/linux/AGENTS.md

@@ -59,13 +59,13 @@ If building on a fresh clone and seeing Boost errors:
 
 ## 2. Virtual Display Setup
 
-### Preferred managed virtual displays (Linux 7.2+)
+### Preferred managed virtual displays (Linux 7.1+)
 
 Native Vibeshine installations include the `vibeshine_drm` source. Native package hooks and
 `vibeshine-drm-setup.service` attempt to register it with DKMS or build it for the running kernel.
-It targets the Linux 7.2 DRM APIs and provides a separate `/sys/kernel/config/vibeshine-drm`
-namespace, so it can coexist with stock VKMS. Install (or retry) the module and enable the
-four-output private pool with:
+It targets the Linux 7.2 DRM APIs with a Linux 7.1 compatibility shim and provides a separate
+`/sys/kernel/config/vibeshine-drm` namespace, so it can coexist with stock VKMS. Install (or retry)
+the module and enable the four-output private pool with:
 
 ```bash
 sudo /usr/libexec/vibeshine/vibeshine-drm-install install
@@ -87,13 +87,14 @@ their modes, layout, and HDR state. Vibeshine routes managed HDR capture through
 the 10-bit scanout reaches VAAPI or NVENC; KWin ScreenCast remains recommended for SDR capture. If
 the custom module cannot build or load, managed virtual displays remain unavailable. The helper
 does not use stock VKMS because its CPU-backed scanout violates the managed-display latency
-contract. Secure Boot requires a trusted module signature.
+contract. Strict module-signature enforcement requires shim/MOK trust or a custom kernel key;
+stock Arch and CachyOS kernels allow a signed external module with the normal module taint.
 
 ### Reference-host forced-EDID setup
 
 The setup below records this repository's older Linux 6.19 reference host. It remains useful for a
 physical dummy connector or a kernel that cannot run `vibeshine_drm`, but it is not required for the
-managed pool on Linux 7.2+.
+managed pool on Linux 7.1+.
 
 Vibeshine streams to a **virtual display** on HDMI-A-2 (a physically disconnected port) using a custom EDID loaded by the kernel at boot.
 

docs/linux/LEARNINGS.md

@@ -253,7 +253,7 @@ groups $USER | grep -E "input|video|render"
 
 ## 11. Virtual Display Setup (EDID Method)
 
-> **Preferred current setup:** On Linux 7.2 or newer, native package hooks and
+> **Preferred current setup:** On Linux 7.1 or newer, native package hooks and
 > `vibeshine-drm-setup.service` attempt to build or register the packaged `vibeshine_drm` module.
 > Run `sudo /usr/libexec/vibeshine/vibeshine-drm-install install` to install or retry it manually,
 > then run `sudo systemctl enable --now vibeshine-vkms.service` to provision four dormant managed
@@ -266,8 +266,11 @@ groups $USER | grep -E "input|video|render"
 > and plane support. Managed HDR capture uses direct DRM/KMS so the 10-bit scanout reaches the
 > encoder; KWin ScreenCast remains the recommended SDR path. If the module cannot be built or
 > loaded, managed virtual displays remain unavailable rather than using CPU-backed stock VKMS.
-> Secure Boot requires a trusted module signature. The remainder of this
-> section documents the legacy forced-EDID method for a physical connector.
+> The installer signs and verifies each module automatically. Stock Arch and
+> CachyOS kernels permit an untrusted external signature with the normal module
+> taint. Strict signature enforcement requires shim/MOK enrollment plus
+> MOK-list trust; an `sbctl` EFI owner key is not a Linux module key. The remainder
+> of this section documents the legacy forced-EDID method for a physical connector.
 
 ### Problem
 Need to stream without physical monitor, or stream while monitor is off.

packaging/linux/Arch/PKGBUILD

@@ -7,7 +7,7 @@
 : "${_commit:=@GITHUB_COMMIT@}"
 
 pkgname='sunshine'
-pkgver=@PROJECT_VERSION@@SUNSHINE_SUB_VERSION@
+pkgver=@SUNSHINE_ARCH_PKGVER@@SUNSHINE_SUB_VERSION@
 pkgrel=1
 pkgdesc="@PROJECT_DESCRIPTION@"
 arch=('x86_64' 'aarch64')
@@ -48,7 +48,7 @@ depends=(
   'libxtst'
   'make'
   'miniupnpc'
-  'mokutil'
+  'mokutil>=0.7.2'
   'numactl'
   'openssl'
   'opus'
@@ -74,7 +74,7 @@ optdepends=(
   'libva-mesa-driver: AMD GPU encoding support'
   'linux-cachyos-headers: build the virtual-display module for the standard CachyOS kernel'
   'linux-headers: build the virtual-display module for the standard Arch kernel'
-  'shim-signed: make enrolled MOK keys available to the Linux kernel under Secure Boot'
+  'shim-signed: provide a signed shim boot chain for MOK trust on strict Secure Boot systems'
 )
 
 provides=()

packaging/linux/Arch/sunshine.install

@@ -13,16 +13,22 @@ do_udev_reload() {
 }
 
 do_install_vibeshine_drm() {
-  if /usr/libexec/vibeshine/vibeshine-drm-install install; then
+  if /usr/libexec/vibeshine/vibeshine-drm-install install-package; then
     return 0
   else
     local install_rc=$?
   fi
-  if ((install_rc == 4)); then
-    echo "warning: Vibeshine DRM was updated, but the loaded module is stale; reboot before using managed virtual displays."
-  else
-    echo "warning: Vibeshine DRM installation failed; managed virtual displays are unavailable."
-  fi
+  case $install_rc in
+    4)
+      echo "warning: Vibeshine DRM was updated, but the loaded module is stale; reboot before using managed virtual displays."
+      ;;
+    5)
+      echo "Vibeshine DRM authorization is queued. Reboot and approve the pending MOK confirmations once."
+      ;;
+    *)
+      echo "warning: Vibeshine DRM installation failed; managed virtual displays are unavailable."
+      ;;
+  esac
 }
 
 post_install() {

src_assets/common/assets/web/public/assets/locale/en.json

@@ -492,7 +492,7 @@
     "dd_virtual_display_scale": "Virtual Display Scale",
     "dd_virtual_display_scale_desc": "Overrides virtual display scaling. Automatic chooses the recommended scale for the requested display mode.",
     "virtual_display_outputs": "Linux private display connectors",
-    "virtual_display_outputs_desc": "Optional comma-separated DRM connector names reserved for private streams. Leave empty to use the four-output managed pool. On Linux 7.2+, Vibeshine DRM provides GPU-attached HDR10 and 10-bit output; HDR uses direct KMS capture, KWin is recommended for SDR, and managed display creation fails if the custom driver is unavailable.",
+    "virtual_display_outputs_desc": "Optional comma-separated DRM connector names reserved for private streams. Leave empty to use the four-output managed pool. On Linux 7.1+, Vibeshine DRM provides GPU-attached HDR10 and 10-bit output; HDR uses direct KMS capture, KWin is recommended for SDR, and managed display creation fails if the custom driver is unavailable.",
     "remote_monitor_mute_audio": "Mute audio on Remote Monitor",
     "remote_monitor_mute_audio_desc": "Send picture and input without sending game or desktop audio to the Remote Monitor client.",
     "remote_monitor_disconnect_on_stream_end": "Remove Remote Monitor when its stream ends",

src_assets/common/assets/web/public/assets/locale/ui/en.json

@@ -1507,7 +1507,7 @@
           "label": "Display scaling"
         },
         "virtual_display_outputs": {
-          "description": "Optional comma-separated DRM connector names reserved for private streams. Leave empty to use the four-output managed pool. On Linux 7.2+, Vibeshine DRM provides GPU-attached HDR10 and 10-bit output; HDR uses direct KMS capture, KWin is recommended for SDR, and managed display creation fails if the custom driver is unavailable.",
+          "description": "Optional comma-separated DRM connector names reserved for private streams. Leave empty to use the four-output managed pool. On Linux 7.1+, Vibeshine DRM provides GPU-attached HDR10 and 10-bit output; HDR uses direct KMS capture, KWin is recommended for SDR, and managed display creation fails if the custom driver is unavailable.",
           "label": "Linux private display connectors"
         },
         "remote_monitor_mute_audio": {