37 lines
No EOL
1.3 KiB
Nix
37 lines
No EOL
1.3 KiB
Nix
{ pkgs, config, ... }:
|
|
{
|
|
environment.systemPackages = with pkgs; [
|
|
sbctl
|
|
];
|
|
|
|
# The 99 here ensures that this runs AFTER the grub activation scripts.
|
|
system.activationScripts."99-sign-all" = {
|
|
text = ''
|
|
if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
|
|
# `sbctl verify --json` returns "null" if there is an error,
|
|
# empty string if there are no files in the database.
|
|
if [ "$(${pkgs.sbctl}/bin/sbctl verify --json)" != "null" ]; then
|
|
|
|
echo "Signing all EFI binaries with sbctl..."
|
|
|
|
ESP="${config.boot.loader.efi.efiSysMountPoint}"
|
|
readarray -t files < <(find "$ESP" -type f -iname "*.efi" -o -iname "*bzImage")
|
|
|
|
# Removing all the files first.
|
|
for file in "${"$"}{files[@]}"; do
|
|
echo "Removing from sbctl: $file"
|
|
# The `|| true` part is because otherwise some files might not exist and
|
|
# the script would return an error.
|
|
${pkgs.sbctl}/bin/sbctl remove-file "$file" >/dev/null 2>&1 || true
|
|
done
|
|
|
|
for file in "${"$"}{files[@]}"; do
|
|
echo "Signing with sbctl: $file"
|
|
${pkgs.sbctl}/bin/sbctl sign -s "$file" >/dev/null 2>&1
|
|
done
|
|
|
|
fi
|
|
fi
|
|
'';
|
|
};
|
|
} |