diff options
Diffstat (limited to 'raveos-app-installer/secureboot/installed')
3 files changed, 74 insertions, 0 deletions
diff --git a/raveos-app-installer/secureboot/installed/raveos-sb-resume.service b/raveos-app-installer/secureboot/installed/raveos-sb-resume.service new file mode 100644 index 0000000..d6005b6 --- /dev/null +++ b/raveos-app-installer/secureboot/installed/raveos-sb-resume.service @@ -0,0 +1,7 @@ +[Unit] +Description=RaveOS Secure Boot beallitas befejezese +[Service] +Type=oneshot +ExecStart=/usr/bin/raveos-secureboot-setup --resume +[Install] +WantedBy=multi-user.target diff --git a/raveos-app-installer/secureboot/installed/raveos-sb-sign-local.sh b/raveos-app-installer/secureboot/installed/raveos-sb-sign-local.sh new file mode 100755 index 0000000..af20118 --- /dev/null +++ b/raveos-app-installer/secureboot/installed/raveos-sb-sign-local.sh @@ -0,0 +1,50 @@ +#!/bin/bash +set -u + +KEY=/etc/raveos/secureboot/machine.key +CERT=/etc/raveos/secureboot/machine.pem +SIGNFILE=/usr/local/bin/raveos-sign-file +[[ -f "$KEY" && -f "$CERT" ]] || exit 0 +command -v sbsign >/dev/null 2>&1 || exit 0 + +signed=0 + +for f in /boot/vmlinuz-* /boot/memtest86+/memtest.efi /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI; do + [[ -f "$f" ]] || continue + case "$f" in *.signed) continue ;; esac + if sbverify --cert "$CERT" "$f" >/dev/null 2>&1; then + continue + fi + if sbsign --key "$KEY" --cert "$CERT" --output "${f}.signed" "$f" 2>/dev/null; then + mv "${f}.signed" "$f" + signed=$((signed + 1)) + fi +done + +if [[ -x "$SIGNFILE" ]]; then + for d in /usr/lib/modules/*/; do + for sub in extramodules updates/dkms extras; do + [[ -d "${d}${sub}" ]] || continue + while IFS= read -r -d '' f; do + modinfo -F signer "$f" 2>/dev/null | grep -q "RaveOS Machine Key" && continue + case "$f" in + *.ko) + "$SIGNFILE" sha512 "$KEY" "$CERT" "$f" >/dev/null 2>&1 && signed=$((signed + 1)) + ;; + *.ko.zst) + tmp="$(mktemp -d)" + if zstd -q -d -c "$f" > "$tmp/m.ko" 2>/dev/null && + "$SIGNFILE" sha512 "$KEY" "$CERT" "$tmp/m.ko" >/dev/null 2>&1 && + zstd -q -f -o "$f" "$tmp/m.ko" 2>/dev/null; then + signed=$((signed + 1)) + fi + rm -rf "$tmp" + ;; + esac + done < <(find "${d}${sub}" -type f \( -name '*.ko' -o -name '*.ko.zst' \) -print0 2>/dev/null) + done + done +fi + +[ "$signed" -gt 0 ] && echo "[raveos-sb] $signed fajl ujraalairva" +exit 0 diff --git a/raveos-app-installer/secureboot/installed/zz-raveos-sb-sign.hook b/raveos-app-installer/secureboot/installed/zz-raveos-sb-sign.hook new file mode 100644 index 0000000..cf64ee2 --- /dev/null +++ b/raveos-app-installer/secureboot/installed/zz-raveos-sb-sign.hook @@ -0,0 +1,17 @@ +[Trigger] +Operation = Install +Operation = Upgrade +Type = Package +Target = linux-cachyos +Target = linux +Target = nvidia +Target = nvidia-dkms +Target = nvidia-open +Target = nvidia-open-dkms +Target = systemd +Target = dkms + +[Action] +Description = RaveOS Secure Boot: bootlanc + out-of-tree modulok ujraalairasa... +When = PostTransaction +Exec = /usr/local/bin/raveos-sb-sign-local.sh |