From 12f9ba2a06f2ab944aa5b42fcfe5d5eb377b869a Mon Sep 17 00:00:00 2001 From: Nowa Ammerlaan Date: Fri, 12 Jun 2026 11:06:57 +0200 Subject: [PATCH] kernel-build.eclass: respect SECUREBOOT_SIGN_TOOL when signing UKI secureboot.eclass now has an optional SECUREBOOT_SIGN_TOOL parameter. Pass this on to ukify to ensure the selected tool is used to sign the generic UKI as well. Signed-off-by: Nowa Ammerlaan Part-of: https://codeberg.org/gentoo/gentoo/pulls/1129 Merges: https://codeberg.org/gentoo/gentoo/pulls/1129 --- eclass/kernel-build.eclass | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/eclass/kernel-build.eclass b/eclass/kernel-build.eclass index 66c32981dfef7..740ef06812610 100644 --- a/eclass/kernel-build.eclass +++ b/eclass/kernel-build.eclass @@ -686,9 +686,14 @@ kernel-build_src_install() { --signing-engine="pkcs11" ) fi + # systemd-sbsign does not support --sign-kernel. + # Disable unconditionally since we know the kernel + # image is already signed always. ukify_args+=( --secureboot-private-key="${SECUREBOOT_SIGN_KEY}" --secureboot-certificate="${SECUREBOOT_SIGN_CERT}" + --signtool="${SECUREBOOT_SIGN_TOOL}" + --no-sign-kernel ) fi if [[ -n ${MEASUREDBOOT_SIGN_KEY} ]]; then