3a17504dd0
- scripts/secureboot/gen-keys.sh: generates a Machine Owner Key pair (MOK.priv / MOK.pem / MOK.der) for self-signing the boot chain. - scripts/secureboot/sign-image.sh: signs kernels and EFI binaries (already-signed files skipped) with sbsign. - arcline-mok-enroll.service (+ script): one-time MOK enrollment at first boot via mokutil; no-ops when no key was shipped. - build-iso.sh: ARCLINE_SIGN=1 signs the live boot chain and ships the public MOK in the image. Smoke test now asserts the enroll unit exists.
24 lines
780 B
Bash
Executable File
24 lines
780 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Arcline OS — one-time MOK enrollment (runs at first boot, then disables itself)
|
|
# No-op when no key was shipped in the image (secure boot off by default).
|
|
set -euo pipefail
|
|
|
|
KEY=/etc/arcline/MOK.der
|
|
UNIT=arcline-mok-enroll.service
|
|
|
|
if [[ ! -f "$KEY" ]]; then
|
|
echo "arcline: no MOK key shipped — secure boot enrollment skipped"
|
|
systemctl disable --now "$UNIT" 2>/dev/null || true
|
|
exit 0
|
|
fi
|
|
|
|
if mokutil --test-key "$KEY" 2>/dev/null | grep -q enabled; then
|
|
echo "arcline: MOK already enrolled"
|
|
else
|
|
echo "arcline: importing MOK — you will be prompted to confirm it on the next reboot"
|
|
mokutil --import "$KEY" || true
|
|
fi
|
|
|
|
# enrollment is one-time; disable ourselves so this never runs again
|
|
systemctl disable --now "$UNIT" 2>/dev/null || true
|