I guess Fedora running xz manually in the spec because it needs to strip debuginfo before signing. Maybe we have to do that, too; i.e. compress in an extra step after pesign, instead of doing via CONFIG_MODULE_COMPRESS. But in our case it might be more tricky, because pesign is performed in the second run. If we run xz at that point, the file list itself will vary. BTW, my hacked version of rpm seems still somehow buggy...