refactoring

modules/mizukios/features/system/sbctl.nix

@@ -0,0 +1,37 @@
+{ pkgs, config, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    sbctl
+  ];
+ 
+  # The 99 here ensures that this runs AFTER the grub activation scripts.
+  system.activationScripts."99-sign-all" = {
+    text = ''
+      if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
+        # `sbctl verify --json` returns "null" if there is an error,
+        # empty string if there are no files in the database.
+        if [ "$(${pkgs.sbctl}/bin/sbctl verify --json)" != "null" ]; then
+ 
+          echo "Signing all EFI binaries with sbctl..."
+ 
+          ESP="${config.boot.loader.efi.efiSysMountPoint}"
+          readarray -t files < <(find "$ESP" -type f -iname "*.efi" -o -iname "*bzImage")
+ 
+          # Removing all the files first.
+          for file in "${"$"}{files[@]}"; do
+            echo "Removing from sbctl: $file"
+            # The `|| true` part is because otherwise some files might not exist and
+            # the script would return an error.
+            ${pkgs.sbctl}/bin/sbctl remove-file "$file" >/dev/null 2>&1 || true
+          done
+ 
+          for file in "${"$"}{files[@]}"; do
+            echo "Signing with sbctl: $file"
+            ${pkgs.sbctl}/bin/sbctl sign -s "$file" >/dev/null 2>&1
+          done
+ 
+        fi
+      fi
+    '';
+  };
+}