feat: add auto secure boot to new kernel update

2026-07-28 13:16:02 +02:00
parent 61e0e1e840
commit 937fced108
9 changed files with 436 additions and 9 deletions
--- a/secureboot/secureboot-sign-cachyos
+++ b/secureboot/secureboot-sign-cachyos
@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CONFIG=/etc/cachyos-updater/secureboot.conf
+if [[ -r "$CONFIG" ]]; then
+    # Le fichier est installé et contrôlé par root.
+    # shellcheck source=/dev/null
+    source "$CONFIG"
+fi
+
+KEY=${SECURE_BOOT_KEY:-/root/secureboot-mok/MOK.key}
+CERT=${SECURE_BOOT_CERT:-/root/secureboot-mok/MOK.crt}
+ESP=${SECURE_BOOT_ESP:-/boot/efi}
+SBAT=${SECURE_BOOT_SBAT:-/usr/share/grub/sbat.csv}
+GRUB_MODULES="all_video bli boot chain configfile echo efi_gop efi_uga ext2 fat font gettext gfxmenu gfxterm gzio linux loadenv normal part_gpt part_msdos png search search_fs_uuid search_label terminal video video_bochs video_cirrus"
+
+die() {
+    echo "Secure Boot : $*" >&2
+    exit 1
+}
+
+[[ $EUID -eq 0 ]] || die "le signer doit être exécuté en root"
+
+for command in findmnt grub-install install sbverify sbsign; do
+    command -v "$command" >/dev/null 2>&1 \
+        || die "commande requise introuvable : $command"
+done
+
+[[ -r "$KEY" ]] || die "clé privée introuvable : $KEY"
+[[ -r "$CERT" ]] || die "certificat introuvable : $CERT"
+[[ -r "$SBAT" ]] || die "fichier SBAT introuvable : $SBAT"
+
+if ! findmnt --mountpoint "$ESP" >/dev/null 2>&1; then
+    echo "Secure Boot : montage de $ESP"
+    mount "$ESP"
+fi
+
+ESP_FS=$(findmnt --noheadings --output FSTYPE --mountpoint "$ESP" | tr -d '[:space:]')
+[[ "$ESP_FS" == "vfat" ]] \
+    || die "$ESP n'est pas une partition EFI vfat montée (type : ${ESP_FS:-inconnu})"
+
+if [[ ${1:-} == "--prepare" ]]; then
+    echo "Secure Boot : pré-vérification réussie sur $ESP"
+    exit 0
+elif [[ $# -gt 0 ]]; then
+    die "option inconnue : $1"
+fi
+
+sign_if_needed() {
+    local file=$1
+    local tmp
+
+    [[ -f "$file" ]] || return 0
+    if sbverify --cert "$CERT" "$file" >/dev/null 2>&1; then
+        return 0
+    fi
+
+    tmp="${file}.signed.$$"
+    trap 'rm -f "$tmp"' RETURN
+    sbsign --key "$KEY" --cert "$CERT" --output "$tmp" "$file" >/dev/null
+    chown --reference="$file" "$tmp"
+    chmod --reference="$file" "$tmp"
+    mv "$tmp" "$file"
+    trap - RETURN
+}
+
+verify_signature() {
+    local file=$1
+    sbverify --cert "$CERT" "$file" >/dev/null 2>&1 \
+        || die "signature MOK invalide : $file"
+}
+
+grub-install \
+    --target=x86_64-efi \
+    --efi-directory="$ESP" \
+    --bootloader-id=CACHYOS \
+    --modules="$GRUB_MODULES" \
+    --sbat="$SBAT" \
+    --no-nvram
+
+install -d "$ESP/EFI/CACHYOS" "$ESP/EFI/BOOT"
+for component in shimx64.efi mmx64.efi fbx64.efi; do
+    [[ -r "/usr/share/shim-signed/$component" ]] \
+        || die "composant shim introuvable : $component"
+    install -m 0644 \
+        "/usr/share/shim-signed/$component" \
+        "$ESP/EFI/CACHYOS/${component^^}"
+    install -m 0644 \
+        "/usr/share/shim-signed/$component" \
+        "$ESP/EFI/BOOT/${component^^}"
+done
+
+sign_if_needed "$ESP/EFI/CACHYOS/GRUBX64.EFI"
+install -m 0644 \
+    "$ESP/EFI/CACHYOS/GRUBX64.EFI" \
+    "$ESP/EFI/BOOT/GRUBX64.EFI"
+
+shopt -s nullglob
+kernels=(/boot/vmlinuz-*)
+[[ ${#kernels[@]} -gt 0 ]] || die "aucun noyau trouvé dans /boot"
+for kernel in "${kernels[@]}"; do
+    sign_if_needed "$kernel"
+done
+
+verify_signature "$ESP/EFI/CACHYOS/GRUBX64.EFI"
+verify_signature "$ESP/EFI/BOOT/GRUBX64.EFI"
+for kernel in "${kernels[@]}"; do
+    verify_signature "$kernel"
+done
+
+sync
+echo "Secure Boot : GRUB et ${#kernels[@]} noyau(x) signés et vérifiés"