wow

modules/mizukios/features/system/sbctl.nix

@@ -1,37 +1,21 @@
-{ pkgs, config, ... }:
+{ config, pkgs, ... }:
 {
   environment.systemPackages = with pkgs; [
     sbctl
   ];
- 
-  # The 99 here ensures that this runs AFTER the grub activation scripts.
-  system.activationScripts."99-sign-all" = {
+
+  # Keep the signing database up to date if a kernel is generated without a
+  # GRUB reinstall.  GRUB itself is signed by boot.nix after installation.
+  system.activationScripts."99-sign-secure-boot-kernels" = {
     text = ''
-      if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
-        # `sbctl verify --json` returns "null" if there is an error,
-        # empty string if there are no files in the database.
-        if [ "$(${pkgs.sbctl}/bin/sbctl verify --json)" != "null" ]; then
- 
-          echo "Signing all EFI binaries with sbctl..."
- 
-          ESP="${config.boot.loader.efi.efiSysMountPoint}"
-          readarray -t files < <(find "$ESP" -type f -iname "*.efi" -o -iname "*bzImage")
- 
-          # Removing all the files first.
-          for file in "${"$"}{files[@]}"; do
-            echo "Removing from sbctl: $file"
-            # The `|| true` part is because otherwise some files might not exist and
-            # the script would return an error.
-            ${pkgs.sbctl}/bin/sbctl remove-file "$file" >/dev/null 2>&1 || true
-          done
- 
-          for file in "${"$"}{files[@]}"; do
-            echo "Signing with sbctl: $file"
-            ${pkgs.sbctl}/bin/sbctl sign -s "$file" >/dev/null 2>&1
-          done
- 
+      if [ -r /var/lib/sbctl/keys/db/db.key ]; then
+        if [ -d "${config.boot.loader.efi.efiSysMountPoint}/kernels" ]; then
+          ${pkgs.findutils}/bin/find \
+            "${config.boot.loader.efi.efiSysMountPoint}/kernels" \
+            -type f -name '*-bzImage' \
+            -exec ${pkgs.sbctl}/bin/sbctl sign -s {} \; || true
         fi
       fi
     '';
   };
-}
+}