Update the mkinitcpio post hook to only sign the kernel/UKI which is currently being built instead of all the files in the sbctl database #285
Conversation
…currently being built instead of all the files in the sbctl database
into-the-v0id
temporarily deployed
to
Build, sign, release binaries
GitHub Actions
Inactive
into-the-v0id
temporarily deployed
to
Build, sign, release binaries
GitHub Actions
Inactive
into-the-v0id
temporarily deployed
to
Build, sign, release binaries
GitHub Actions
Inactive
|
Thanks! |
|
@Foxboron any plan to release this fix? |
|
@TiagodePAlves Can probably try and do a release one of the up comming weekends. |
| echo "Signing EFI binaries..." | ||
| /usr/bin/sbctl sign-all -g | ||
|
|
||
| KERENEL_FILE="$1" |
| fi | ||
|
|
||
| echo "Signing $IMAGE_FILE" | ||
| sbctl sign -s "$IMAGE_FILE" |
There was a problem hiding this comment.
Well, this has already been merged, but I think the -s is right here. Initramfs files should always be saved to the database and resigned as soon as possible, when necessary.
There was a problem hiding this comment.
problem is they're never removed from the sbctl "database", so if you remove the uki, now the sbctl database is out-of-sync
There was a problem hiding this comment.
In that case, sbctl will just display an error, but the exit code will still be zero. So you can just remove from the database file manually when you see the message. That's why the current behavior is ok IMHO.
See #284 for details on the problem.
This PR updates the mkinitcpio post hook to only sign the kernel/UKI which is currently being built instead of all the files in the sbctl database.
References:
Fixes #284