3a17504dd0
- scripts/secureboot/gen-keys.sh: generates a Machine Owner Key pair (MOK.priv / MOK.pem / MOK.der) for self-signing the boot chain. - scripts/secureboot/sign-image.sh: signs kernels and EFI binaries (already-signed files skipped) with sbsign. - arcline-mok-enroll.service (+ script): one-time MOK enrollment at first boot via mokutil; no-ops when no key was shipped. - build-iso.sh: ARCLINE_SIGN=1 signs the live boot chain and ships the public MOK in the image. Smoke test now asserts the enroll unit exists.
46 lines
2.2 KiB
Bash
Executable File
46 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Arcline OS — secure boot: MOK key generation
|
|
#
|
|
# scripts/secureboot/gen-keys.sh [--keydir build/keys]
|
|
#
|
|
# Generates a Machine Owner Key (MOK) signing keypair for self-signing the
|
|
# kernel and EFI boot chain. MOK is the pragmatic secure-boot path for a
|
|
# self-hosted distro: you enroll the key once (one-time prompt at first boot)
|
|
# and then every Arcline update is verified against it. No third-party CA.
|
|
#
|
|
# Outputs (default build/keys/):
|
|
# MOK.priv — private signing key (keep this secret, back it up)
|
|
# MOK.pem — certificate in PEM form (for sbsign)
|
|
# MOK.der — certificate in DER form (for mokutil enrollment)
|
|
#
|
|
# Requires openssl. Enrollment on a target system is handled by
|
|
# arcline-mok-enroll.service (see overlays/base).
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
set -euo pipefail
|
|
source "$(dirname "${BASH_SOURCE[0]}")/../../scripts/common.sh"
|
|
|
|
KEYDIR="${1:-$BUILD_DIR/keys}"
|
|
[[ "${1:-}" == "--keydir" ]] && KEYDIR="${2:?usage: gen-keys.sh [--keydir <dir>]}"
|
|
|
|
command -v openssl >/dev/null || die "openssl not found"
|
|
|
|
if [[ -f "$KEYDIR/MOK.priv" && -f "$KEYDIR/MOK.pem" && -f "$KEYDIR/MOK.der" ]]; then
|
|
log "MOK keypair already exists in $KEYDIR — keeping it (delete to regenerate)"
|
|
exit 0
|
|
fi
|
|
|
|
mkdir -p "$KEYDIR"
|
|
log "generating MOK signing keypair in $KEYDIR"
|
|
openssl req -new -x509 -newkey rsa:3072 -sha256 -nodes \
|
|
-keyout "$KEYDIR/MOK.priv" \
|
|
-outform DER -out "$KEYDIR/MOK.der" \
|
|
-subj "/CN=Arcline OS MOK/OU=Secure Boot/O=Arcline IT LLC" \
|
|
-days 3650
|
|
openssl x509 -in "$KEYDIR/MOK.der" -inform DER -out "$KEYDIR/MOK.pem" -outform PEM
|
|
|
|
chmod 600 "$KEYDIR/MOK.priv"
|
|
log "generated: MOK.priv (keep secret), MOK.pem, MOK.der"
|
|
log "to enroll on a running system:"
|
|
log " sudo mokutil --import $KEYDIR/MOK.der"
|