libcamera: re-sign IPA modules after fixup

[steinuil]

Re-introduced the postFixup IPA module re-signing step that was erroneously removed in fb0ddd9 to address #351842.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[uninsane]

it's a heavy rebuild count but this is a pretty significant bugfix for desktop users, so targeting master is warranted IMO.

current experience for me on master is that pipewire/libcamera based applications (e.g. gnome snapshot) don't work. but v4l2 camera viewers like megapixels also don't work -- unless i manually stop pipewire/wireplumber. presumably unsigned IPAs break libcamera in such a way that pipewire partially reconfigures the devices, fails, and then leaves them in a broken state. so my camera is effectively unusable by any method, unless i disable pipewire.

cherry-picked this PR and re-deployed my system: everything built fine, cameras are working again.

[steinuil]

Currently the behavior (at least on my device) is that libcamera segfaults after failing to find the IPA proxy so if it already started talking to the camera it makes sense that it'd leave it in a broken state. On my device when libcamera segfaults it also brings down wireplumber and pipewire with it, so if I don't blacklist the kernel module for the camera driver I don't even get any sound!

I'm looking forward to getting this merged so I don't have to recompile webkitgtk on my workstation anymore :)

[github-actions]

Successfully created backport PR for staging-24.11:

• [Backport staging-24.11] libcamera: re-sign IPA modules after fixup #360324

[github-actions]

Git push to origin failed for staging-24.11 with exitcode 1

[vcunat]

Given how long the bug's been (reportedly) present (e.g. it was there on the first release of 24.05), I really doubt that it's become so urgent now. Still, the rebuild isn't huge and staging-next should give it a chance to get into master relatively fast.