From 91978706279a19a3ac96393630876f3e50cbc518 Mon Sep 17 00:00:00 2001
From: Nippy <nippy@Nippy-Mac-mini.local>
Date: Fri, 9 Oct 2026 10:49:26 +0200
Subject: fix

---
 .../secureboot/installed/raveos-sb-resume.service  |  7 +++
 .../secureboot/installed/raveos-sb-sign-local.sh   | 50 ++++++++++++++++++++++
 .../secureboot/installed/zz-raveos-sb-sign.hook    | 17 ++++++++
 3 files changed, 74 insertions(+)
 create mode 100644 raveos-app-installer/secureboot/installed/raveos-sb-resume.service
 create mode 100755 raveos-app-installer/secureboot/installed/raveos-sb-sign-local.sh
 create mode 100644 raveos-app-installer/secureboot/installed/zz-raveos-sb-sign.hook

(limited to 'raveos-app-installer/secureboot/installed')

diff --git a/raveos-app-installer/secureboot/installed/raveos-sb-resume.service b/raveos-app-installer/secureboot/installed/raveos-sb-resume.service
new file mode 100644
index 0000000..d6005b6
--- /dev/null
+++ b/raveos-app-installer/secureboot/installed/raveos-sb-resume.service
@@ -0,0 +1,7 @@
+[Unit]
+Description=RaveOS Secure Boot beallitas befejezese
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/raveos-secureboot-setup --resume
+[Install]
+WantedBy=multi-user.target
diff --git a/raveos-app-installer/secureboot/installed/raveos-sb-sign-local.sh b/raveos-app-installer/secureboot/installed/raveos-sb-sign-local.sh
new file mode 100755
index 0000000..af20118
--- /dev/null
+++ b/raveos-app-installer/secureboot/installed/raveos-sb-sign-local.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+set -u
+
+KEY=/etc/raveos/secureboot/machine.key
+CERT=/etc/raveos/secureboot/machine.pem
+SIGNFILE=/usr/local/bin/raveos-sign-file
+[[ -f "$KEY" && -f "$CERT" ]] || exit 0
+command -v sbsign >/dev/null 2>&1 || exit 0
+
+signed=0
+
+for f in /boot/vmlinuz-* /boot/memtest86+/memtest.efi /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI; do
+    [[ -f "$f" ]] || continue
+    case "$f" in *.signed) continue ;; esac
+    if sbverify --cert "$CERT" "$f" >/dev/null 2>&1; then
+        continue
+    fi
+    if sbsign --key "$KEY" --cert "$CERT" --output "${f}.signed" "$f" 2>/dev/null; then
+        mv "${f}.signed" "$f"
+        signed=$((signed + 1))
+    fi
+done
+
+if [[ -x "$SIGNFILE" ]]; then
+    for d in /usr/lib/modules/*/; do
+        for sub in extramodules updates/dkms extras; do
+            [[ -d "${d}${sub}" ]] || continue
+            while IFS= read -r -d '' f; do
+                modinfo -F signer "$f" 2>/dev/null | grep -q "RaveOS Machine Key" && continue
+                case "$f" in
+                    *.ko)
+                        "$SIGNFILE" sha512 "$KEY" "$CERT" "$f" >/dev/null 2>&1 && signed=$((signed + 1))
+                        ;;
+                    *.ko.zst)
+                        tmp="$(mktemp -d)"
+                        if zstd -q -d -c "$f" > "$tmp/m.ko" 2>/dev/null &&
+                           "$SIGNFILE" sha512 "$KEY" "$CERT" "$tmp/m.ko" >/dev/null 2>&1 &&
+                           zstd -q -f -o "$f" "$tmp/m.ko" 2>/dev/null; then
+                            signed=$((signed + 1))
+                        fi
+                        rm -rf "$tmp"
+                        ;;
+                esac
+            done < <(find "${d}${sub}" -type f \( -name '*.ko' -o -name '*.ko.zst' \) -print0 2>/dev/null)
+        done
+    done
+fi
+
+[ "$signed" -gt 0 ] && echo "[raveos-sb] $signed fajl ujraalairva"
+exit 0
diff --git a/raveos-app-installer/secureboot/installed/zz-raveos-sb-sign.hook b/raveos-app-installer/secureboot/installed/zz-raveos-sb-sign.hook
new file mode 100644
index 0000000..cf64ee2
--- /dev/null
+++ b/raveos-app-installer/secureboot/installed/zz-raveos-sb-sign.hook
@@ -0,0 +1,17 @@
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Package
+Target = linux-cachyos
+Target = linux
+Target = nvidia
+Target = nvidia-dkms
+Target = nvidia-open
+Target = nvidia-open-dkms
+Target = systemd
+Target = dkms
+
+[Action]
+Description = RaveOS Secure Boot: bootlanc + out-of-tree modulok ujraalairasa...
+When = PostTransaction
+Exec = /usr/local/bin/raveos-sb-sign-local.sh
-- 
cgit v1.3