movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

nixos/limine: add support for secure boot

Browse source 
Signed-off-by: John Titor <50095635+JohnRTitor@users.noreply.github.com>
This commit is contained in:
programmerlexi 2025-05-18 14:57:11 +02:00 • committed by Masum Reza
parent b97b6308bd
commit 36ecfe6216
6 changed files with 150 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

26
nixos/modules/system/boot/loader/limine/limine-install.py
View file

@ -249,6 +249,10 @@ def main():
partition formatted as FAT.
'''))
if config('secureBoot')['enable'] and not config('secureBoot')['createAndEnrollKeys'] and not os.path.exists("/var/lib/sbctl"):
print("There are no sbctl secure boot keys present. Please generate some.")
sys.exit(1)
if not os.path.exists(limine_dir):
os.makedirs(limine_dir)
else:
@ -352,6 +356,28 @@ def main():
print('error: failed to enroll limine config.', file=sys.stderr)
sys.exit(1)
if config('secureBoot')['enable']:
sbctl = os.path.join(config('secureBoot')['sbctl'], 'bin', 'sbctl')
if config('secureBoot')['createAndEnrollKeys']:
print("TEST MODE: creating and enrolling keys")
try:
subprocess.run([sbctl, 'create-keys'])
except:
print('error: failed to create keys', file=sys.stderr)
sys.exit(1)
try:
subprocess.run([sbctl, 'enroll-keys', '--yes-this-might-brick-my-machine'])
except:
print('error: failed to enroll keys', file=sys.stderr)
sys.exit(1)
print('signing limine...')
try:
subprocess.run([sbctl, 'sign', dest_path])
except:
print('error: failed to sign limine', file=sys.stderr)
sys.exit(1)
if not config('efiRemovable') and not config('canTouchEfiVariables'):
print('warning: boot.loader.efi.canTouchEfiVariables is set to false while boot.loader.limine.efiInstallAsRemovable.\n This may render the system unbootable.')