From 96da52f0e12d19cbe763194fed9a3643d81b021a Mon Sep 17 00:00:00 2001 From: nocode Date: Wed, 8 Jul 2026 02:39:31 +0200 Subject: [PATCH] feat(releng): add pacman hook for secure boot signing after kernel updates Add a new libalpm hook that automatically re-signs bootloader binaries with sbctl after kernel or GRUB updates. This ensures that Secure Boot remains functional after system updates that modify unsigned binaries. The hook triggers on updates to kernel, GRUB, and EFI files, and runs sbctl sign-all to maintain signature consistency. This is idempotent and harmless if sbctl has no enrolled keys. --- .../libalpm/hooks/95-fws-secureboot-sign.hook | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 configs/releng/airootfs/usr/share/libalpm/hooks/95-fws-secureboot-sign.hook diff --git a/configs/releng/airootfs/usr/share/libalpm/hooks/95-fws-secureboot-sign.hook b/configs/releng/airootfs/usr/share/libalpm/hooks/95-fws-secureboot-sign.hook new file mode 100644 index 0000000..2426c6b --- /dev/null +++ b/configs/releng/airootfs/usr/share/libalpm/hooks/95-fws-secureboot-sign.hook @@ -0,0 +1,26 @@ +# ============================================================ +# FWS — re-signature Secure Boot (sbctl) après une MAJ de noyau ou de GRUB. +# +# Sans ça, « pacman -Syu » qui met à jour linux/grub réécrit des binaires NON +# signés → au reboot sous Secure Boot, le firmware refuse de démarrer FWS. +# « sbctl sign-all » re-signe tous les fichiers suivis (idempotent). Complète +# le hook natif de sbctl (filet redondant, sans effet s'il est déjà passé). +# +# Inoffensif tant que sbctl n'a rien enrôlé (sign-all ne fait alors rien). +# ============================================================ +[Trigger] +Type = Path +Operation = Install +Operation = Upgrade +Target = usr/lib/modules/*/vmlinuz +Target = boot/vmlinuz-* +Target = usr/lib/grub/* +Target = boot/grub/x86_64-efi/* +Target = boot/efi/EFI/*/grubx64.efi +Target = efi/EFI/*/grubx64.efi + +[Action] +Description = FWS : re-signature Secure Boot des binaires de boot (sbctl)… +When = PostTransaction +Exec = /usr/bin/sbctl sign-all +Depends = sbctl