21 lines
685 B
Nix
21 lines
685 B
Nix
{ config, pkgs, ... }:
|
|
{
|
|
environment.systemPackages = with pkgs; [
|
|
sbctl
|
|
];
|
|
|
|
# Keep the signing database up to date if a kernel is generated without a
|
|
# GRUB reinstall. GRUB itself is signed by boot.nix after installation.
|
|
system.activationScripts."99-sign-secure-boot-kernels" = {
|
|
text = ''
|
|
if [ -r /var/lib/sbctl/keys/db/db.key ]; then
|
|
if [ -d "${config.boot.loader.efi.efiSysMountPoint}/kernels" ]; then
|
|
${pkgs.findutils}/bin/find \
|
|
"${config.boot.loader.efi.efiSysMountPoint}/kernels" \
|
|
-type f -name '*-bzImage' \
|
|
-exec ${pkgs.sbctl}/bin/sbctl sign -s {} \; || true
|
|
fi
|
|
fi
|
|
'';
|
|
};
|
|
}
|