gentoo-mirror/gentoo
1
0
Fork 0
mirror of https://github.com/gentoo-mirror/gentoo.git synced 2026-09-24 04:59:14 -07:00
Code Issues Projects Releases Wiki Activity

kernel-build.eclass: respect SECUREBOOT_SIGN_TOOL when signing UKI

Browse Source 
secureboot.eclass now has an optional SECUREBOOT_SIGN_TOOL
parameter. Pass this on to ukify to ensure the selected tool is used
to sign the generic UKI as well.

Signed-off-by: Nowa Ammerlaan <nowa@gentoo.org>
Part-of: https://codeberg.org/gentoo/gentoo/pulls/1129
Merges: https://codeberg.org/gentoo/gentoo/pulls/1129
This commit is contained in:
Nowa Ammerlaan
2026-06-12 11:06:57 +02:00
parent 2c3dfd3cb1
commit 12f9ba2a06
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
eclass/kernel-build.eclass
View File

@@ -686,9 +686,14 @@ kernel-build_src_install() {
--signing-engine="pkcs11"
)
fi
# systemd-sbsign does not support --sign-kernel.
# Disable unconditionally since we know the kernel
# image is already signed always.
ukify_args+=(
--secureboot-private-key="${SECUREBOOT_SIGN_KEY}"
--secureboot-certificate="${SECUREBOOT_SIGN_CERT}"
--signtool="${SECUREBOOT_SIGN_TOOL}"
--no-sign-kernel
)
fi
if [[ -n ${MEASUREDBOOT_SIGN_KEY} ]]; then