os-build/arcline-mok-enroll.service at bb031ca92ff62fdc524e8a92aa5979cc7ec3a4eb - os-build - Gitea

arcline-project/os-build

Files

Blake Ridgway 3a17504dd0 feat: add MOK-based secure boot signing

- scripts/secureboot/gen-keys.sh: generates a Machine Owner Key pair
  (MOK.priv / MOK.pem / MOK.der) for self-signing the boot chain.
- scripts/secureboot/sign-image.sh: signs kernels and EFI binaries
  (already-signed files skipped) with sbsign.
- arcline-mok-enroll.service (+ script): one-time MOK enrollment at first
  boot via mokutil; no-ops when no key was shipped.
- build-iso.sh: ARCLINE_SIGN=1 signs the live boot chain and ships the
  public MOK in the image. Smoke test now asserts the enroll unit exists.

2026-08-21 13:33:17 -05:00

14 lines

266 B

Desktop File

Raw Blame History

 [Unit]
 Description=Enroll Arcline secure boot MOK (one-time)
 Documentation=docs/secureboot.md
 DefaultDependencies=no
 Before=sysinit.target
 [Service]
 Type=oneshot
 ExecStart=/usr/local/sbin/arcline-mok-enroll.sh
 RemainAfterExit=yes
 [Install]
 WantedBy=sysinit.target