Dear maintainer,

as of Debian bookworm, the most non-intuitive, difficult for users to
figure out setup step that must be applied on Secure Boot enabled
systems is the following:

     sudo mokutil --import /var/lib/dkms/mok.pub

This is documented in DKMS readme [1] but that is not easily discovered
by users.

Hence my feature request is to enroll DKMS signing key / automate
running "sudo mokutil --import /var/lib/dkms/mok.pub". As far as I
understand the DKMS and update-secureboot-policy source code in Ubuntu,
it seems that this is already a default feature in Ubuntu. In other
words, it seems Ubuntu is automating the DKMS signing key enrollment.

I have also reported this issue upstream to DKMS [2] because according
to DKMS source code comment,

 > Debian's update-secureboot-policy has no --new-key option

this might be a Debian specific issue here, hence also reporting against
Debian's DKMS package.

Cheers,
Patrick

[1] https://github.com/dell/dkms?tab=readme-ov-file#secure-boot

[2] automate running "`sudo mokutil --import /var/lib/dkms/mok.pub`"
https://github.com/dell/dkms/issues/429

Hi,

bts-link tagged #1076269 and #1035707 fixed-upstream on 27 Jul 2026,
after the forwarded upstream issues were closed:

  #1076269 -> https://github.com/dell/dkms/issues/429
  #1035707 -> https://github.com/dell/dkms/issues/372

Both were closed on 26 Jul 2026 by github-actions[bot] for inactivity.
The stale workflow upstream added in June (df834317, "Add stale issue
management") marked them stale on 14 Jun and closed them without a fix.

dkms 3.4.4 still has no action to re-sign installed modules, and the MOK
import with mokutil is only described in README.md as a manual step.
So the fixed-upstream tag is misleading for both bugs.

Viorel