wow

modules/mizukios/features/packages/docker2libc.nix

@@ -14,7 +14,7 @@ pkgs.writeShellApplication {
     #!/usr/bin/env bash
     set -euo pipefail
 
-    image="${1:-tmp-elf-extract}"
+    image="''${1:-tmp-elf-extract}"
 
     docker build -t "$image" .
 
@@ -30,8 +30,8 @@ pkgs.writeShellApplication {
     [ -n "$libc_path" ] || { echo "libc.so.6 not found" >&2; exit 1; }
     [ -n "$ld_path" ] || { echo "ld-linux not found" >&2; exit 1; }
 
-    docker cp -L "${cid}:${libc_path}" ./libc.so.6
-    docker cp -L "${cid}:${ld_path}" ./ld-linux-x86-64.so.2
+    docker cp -L "''${cid}:''${libc_path}" ./libc.so.6
+    docker cp -L "''${cid}:''${ld_path}" ./ld-linux-x86-64.so.2
 
     file libc.so.6 ld-linux-x86-64.so.2
     ls -lh libc.so.6 ld-linux-x86-64.so.2

modules/mizukios/features/system/boot.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 {
   # boot.plymouth.enable = true;
   boot.loader = {
@@ -10,6 +10,36 @@
       device = "nodev";
       enableCryptodisk = true;
 
+      # GRUB is signed directly with the sbctl db key.  Do not use the shim
+      # verifier here; it would reject the NixOS kernel/initrd chain before
+      # GRUB can load it.
+      extraGrubInstallArgs = [
+        "--modules=tpm"
+        "--disable-shim-lock"
+      ];
+
+      # Sign the freshly installed GRUB and NixOS kernels before rebooting.
+      # Key creation/enrollment is intentionally a one-time manual step and
+      # is skipped until /var/lib/sbctl/keys/db/db.key exists.
+      extraInstallCommands = ''
+        if [ -r /var/lib/sbctl/keys/db/db.key ]; then
+          for file in \
+            "${config.boot.loader.efi.efiSysMountPoint}/EFI/NixOS-boot/grubx64.efi" \
+            "${config.boot.loader.efi.efiSysMountPoint}/EFI/BOOT/BOOTX64.EFI"; do
+            if [ -f "$file" ]; then
+              ${pkgs.sbctl}/bin/sbctl sign -s "$file" || true
+            fi
+          done
+
+          if [ -d "${config.boot.loader.efi.efiSysMountPoint}/kernels" ]; then
+            ${pkgs.findutils}/bin/find \
+              "${config.boot.loader.efi.efiSysMountPoint}/kernels" \
+              -type f -name '*-bzImage' \
+              -exec ${pkgs.sbctl}/bin/sbctl sign -s {} \; || true
+          fi
+        fi
+      '';
+
       # extraInstallCommands = ''
       #   mkdir -p /boot/EFI/BOOT
 

modules/mizukios/features/system/sbctl.nix

@@ -1,37 +1,21 @@
-{ pkgs, config, ... }:
+{ config, pkgs, ... }:
 {
   environment.systemPackages = with pkgs; [
     sbctl
   ];
- 
-  # The 99 here ensures that this runs AFTER the grub activation scripts.
-  system.activationScripts."99-sign-all" = {
+
+  # Keep the signing database up to date if a kernel is generated without a
+  # GRUB reinstall.  GRUB itself is signed by boot.nix after installation.
+  system.activationScripts."99-sign-secure-boot-kernels" = {
     text = ''
-      if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
-        # `sbctl verify --json` returns "null" if there is an error,
-        # empty string if there are no files in the database.
-        if [ "$(${pkgs.sbctl}/bin/sbctl verify --json)" != "null" ]; then
- 
-          echo "Signing all EFI binaries with sbctl..."
- 
-          ESP="${config.boot.loader.efi.efiSysMountPoint}"
-          readarray -t files < <(find "$ESP" -type f -iname "*.efi" -o -iname "*bzImage")
- 
-          # Removing all the files first.
-          for file in "${"$"}{files[@]}"; do
-            echo "Removing from sbctl: $file"
-            # The `|| true` part is because otherwise some files might not exist and
-            # the script would return an error.
-            ${pkgs.sbctl}/bin/sbctl remove-file "$file" >/dev/null 2>&1 || true
-          done
- 
-          for file in "${"$"}{files[@]}"; do
-            echo "Signing with sbctl: $file"
-            ${pkgs.sbctl}/bin/sbctl sign -s "$file" >/dev/null 2>&1
-          done
- 
+      if [ -r /var/lib/sbctl/keys/db/db.key ]; then
+        if [ -d "${config.boot.loader.efi.efiSysMountPoint}/kernels" ]; then
+          ${pkgs.findutils}/bin/find \
+            "${config.boot.loader.efi.efiSysMountPoint}/kernels" \
+            -type f -name '*-bzImage' \
+            -exec ${pkgs.sbctl}/bin/sbctl sign -s {} \; || true
         fi
       fi
     '';
   };
-}
+}