# Image requirements for out-of-tree drivers

Quick Setup only enables kernel modules that are already present in the booted
deployment. It intentionally does not compile akmods on the user's machine.

For Broadcom `wl`, follow the prebuilt-akmod pattern but build it using the
exact RHEL kernel shipped by stillOS. Do not consume Fedora `kmod-wl` RPMs: a
module built for a Fedora kernel will not match a RHEL kernel.

The image pipeline must:

1. Install the final kernel and its exactly matching `kernel-devel` package in
   a builder stage.
2. Build the Broadcom `wl` source, including the compatibility patches needed
   by that kernel, with `KERNELRELEASE` set to the final kernel release.
3. Package the module as a versioned `kmod-wl` RPM (preferred), or copy
   it to `/usr/lib/modules/$KERNEL_RELEASE/extra/wl.ko`.
4. Install only that result in the final image, run
   `depmod -a $KERNEL_RELEASE`, and fail the image build unless
   `modinfo -k $KERNEL_RELEASE wl` succeeds.

The essential direct-module portion is:

```Dockerfile
ARG KERNEL_RELEASE
COPY --from=wl-builder /out/wl.ko /usr/lib/modules/${KERNEL_RELEASE}/extra/wl.ko
RUN depmod -a "${KERNEL_RELEASE}" && modinfo -k "${KERNEL_RELEASE}" wl
```

`KERNEL_RELEASE` must be the directory name under `/usr/lib/modules`, not just
the major kernel version. The unsigned module is suitable while stillOS does
not support Secure Boot and does not enforce kernel module signatures. When
Secure Boot support is added, sign this module during the image build using a
persistent stillOS-owned key and ship its public enrollment certificate.

Verify every built image with:

```sh
modinfo -k "$(uname -r)" wl
```

Do not ship only an akmod source package and defer compilation to first boot.
First boot may not have networking, build tools, matching kernel headers, or a
writable `/usr`, which is exactly when this driver is needed.
