1 files changed, 50 insertions, 0 deletions
diff --git a/raveos-app-installer/secureboot/installed/raveos-sb-sign-local.sh b/raveos-app-installer/secureboot/installed/raveos-sb-sign-local.sh
new file mode 100755
index 0000000..af20118
--- /dev/null
+++ b/raveos-app-installer/secureboot/installed/raveos-sb-sign-local.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+set -u
+
+KEY=/etc/raveos/secureboot/machine.key
+CERT=/etc/raveos/secureboot/machine.pem
+SIGNFILE=/usr/local/bin/raveos-sign-file
+[[ -f "$KEY" && -f "$CERT" ]] || exit 0
+command -v sbsign >/dev/null 2>&1 || exit 0
+
+signed=0
+
+for f in /boot/vmlinuz-* /boot/memtest86+/memtest.efi /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI; do
+    [[ -f "$f" ]] || continue
+    case "$f" in *.signed) continue ;; esac
+    if sbverify --cert "$CERT" "$f" >/dev/null 2>&1; then
+        continue
+    fi
+    if sbsign --key "$KEY" --cert "$CERT" --output "${f}.signed" "$f" 2>/dev/null; then
+        mv "${f}.signed" "$f"
+        signed=$((signed + 1))
+    fi
+done
+
+if [[ -x "$SIGNFILE" ]]; then
+    for d in /usr/lib/modules/*/; do
+        for sub in extramodules updates/dkms extras; do
+            [[ -d "${d}${sub}" ]] || continue
+            while IFS= read -r -d '' f; do
+                modinfo -F signer "$f" 2>/dev/null | grep -q "RaveOS Machine Key" && continue
+                case "$f" in
+                    *.ko)
+                        "$SIGNFILE" sha512 "$KEY" "$CERT" "$f" >/dev/null 2>&1 && signed=$((signed + 1))
+                        ;;
+                    *.ko.zst)
+                        tmp="$(mktemp -d)"
+                        if zstd -q -d -c "$f" > "$tmp/m.ko" 2>/dev/null &&
+                           "$SIGNFILE" sha512 "$KEY" "$CERT" "$tmp/m.ko" >/dev/null 2>&1 &&
+                           zstd -q -f -o "$f" "$tmp/m.ko" 2>/dev/null; then
+                            signed=$((signed + 1))
+                        fi
+                        rm -rf "$tmp"
+                        ;;
+                esac
+            done < <(find "${d}${sub}" -type f \( -name '*.ko' -o -name '*.ko.zst' \) -print0 2>/dev/null)
+        done
+    done
+fi
+
+[ "$signed" -gt 0 ] && echo "[raveos-sb] $signed fajl ujraalairva"
+exit 0