search

gdamjan / secure-boot

UEFI SecureBoot for ArchLinux
58 stars 3 forks source link

Trigger hook on changes to initramfs #4

Open kohlerjl opened 6 years ago

kohlerjl commented 6 years ago

Thanks for a well written script to manage secure boot on Arch. It helped me a lot to setup on my own computer.

One potential issue I noticed is that any changes that trigger the mkinitcpio PostTransaction hook to rebuild initramfs-linux.img don't necessarily trigger this script to rebuild and sign the merged initramfs+kernel. To correct that, I have changed the Trigger on my pacman hook to include the same Targets as the hook that builds initramfs-linux.img:

Type = File Target = boot/vmlinuz-linux Target = boot/intel-ucode.img Target = boot/initramfs-linux.img Target = usr/lib/initcpio/*

gdamjan commented 6 years ago

Target = boot/initramfs-linux.img won't work since it's not part of any package.

Have you tried Target = usr/lib/initcpio/* ? does it work well for you?

kohlerjl commented 6 years ago

Ah, yes, it only triggered properly when I added Target = usr/lib/initcpio/*, which has worked well so far, but I haven't tested extensively. I did rename my secure boot hook to 99-secure-boot.hook, to make sure it ran after the mkinitcpio hook, which is named 90-linux.hook

gdamjan commented 6 years ago

I'll make these changes soon (already editied this repo).

The problem with the hooks as it is now, it only runs when the main kernel is updated. In the future, if Arch would move to kernel-install it would be possible to run secure-boot as a hook to it, and update the image for any kernel installed.