sbsigntool: rewrite post-install kernel hook #23688
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ahesford
reviewed
Jul 21, 2020
|
Is it possible to change the options to set/unset instead of checking for 1 to make all the hooks more uniform, without breaking compatibility? Edit: nvm, not possible and this seems to have started with the x1 stuff with the really bad efibootmgr hook, its bad but doesn't really matter too much. |
|
Yes, at the time, I started |
sgn
force-pushed
the
sbsigntool-rewrite-hook
branch
from
f00e6fe
to
956c3f8
Compare
|
Could we add support for the UEFI bundles already? Source |
Sure, will do in the weekend. Have we decided stable variable name for that hook, yet? |
|
I don't think so. It's in #22484. |
|
There weren't complaints about the filename, but there were some comments regarding the variables themselves. I think they are solved, though. |
sgn
force-pushed
the
sbsigntool-rewrite-hook
branch
from
956c3f8
to
5c3284c
Compare
* run the hook on target filesystem * Use ls | awk to check ownership and permission, instead of relying on GNU-stat. * libify signing code, in order to support uefi bundle in the future * Stop append signature to the efi signed by current key/cert. While we're at it, * add post-remove script to remove unsigned file if exist
sgn
force-pushed
the
sbsigntool-rewrite-hook
branch
from
5c3284c
to
4bd83bc
Compare
7 tasks
ahesford
pushed a commit
to ahesford/void-packages
that referenced
this pull request
Aug 6, 2020
* run the hook on target filesystem * Use ls | awk to check ownership and permission, instead of relying on GNU-stat. * libify signing code, in order to support uefi bundle in the future * Stop append signature to the efi signed by current key/cert. While we're at it, * add post-remove script to remove unsigned file if exist Closes void-linux#23688.
sgn
force-pushed
the
sbsigntool-rewrite-hook
branch
from
eeeaea4
to
6fac00c
Compare
- refind-install only supports installing into
{/boot,/boot/efi,/efi}/EFI/{BOOT,refind}/refind.conf, there're no point
trying to fiddling with anything else.
- That configuration file should always exist, simplify all logic behind
that decision.
sgn
force-pushed
the
sbsigntool-rewrite-hook
branch
from
6fac00c
to
53bdcc8
Compare
ahesford
pushed a commit
to ahesford/void-packages
that referenced
this pull request
Aug 7, 2020
* run the hook on target filesystem * Use ls | awk to check ownership and permission, instead of relying on GNU-stat. * libify signing code, in order to support uefi bundle in the future * Stop append signature to the efi signed by current key/cert. While we're at it, * add post-remove script to remove unsigned file if exist Closes void-linux#23688.
MGlolenstine
pushed a commit
to MGlolenstine/void-packages
that referenced
this pull request
Aug 14, 2020
* run the hook on target filesystem * Use ls | awk to check ownership and permission, instead of relying on GNU-stat. * libify signing code, in order to support uefi bundle in the future * Stop append signature to the efi signed by current key/cert. While we're at it, * add post-remove script to remove unsigned file if exist Closes void-linux#23688. Closes void-linux#24079.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
GNU-stat.
While we're at it,
@ericonr @ahesford I think you may be interested on this.