A method for dealing with the "sign in place" problem

[jwodder]

I've come up with the following signing setup that should avoid the problem discussed in #228 while still keeping maintenance mostly automated. These steps aren't universal; specifically, they assume the following setup:

• Arch Linux
• mkinitcpio is used to generate a UKI
• There is no boot manager or other source of EFIs to be signed
• The EFI system partition is at /efi

Important

I have NOT tested this, and I will not be able to test this for some time. Part of the reason I'm posting this is in the hopes of getting feedback as to whether this works properly.

Steps:

• Edit /etc/mkinitcpio.d/linux.preset (which should already have been edited to create a UKI) and change the value of default_uki from /efi/EFI/Linux/arch-linux.efi to /boot/arch-linux.efi.

• Create the file /etc/initcpio/post/sbsign with the contents:

  #!/bin/bash
  uki="$3"
  [[ -n "$uki" ]] || exit 0
  
  mkdir -p /efi/EFI/Linux
  sbctl sign -s -o /efi/EFI/Linux/"$(basename "$uki")" "$uki"

  Make the file executable.

• Delete the mkinitcpio and pacman hooks installed by sbctl at /usr/lib/initcpio/post/sbctl and /usr/share/libalpm/hooks/zz-sbctl.hook. Then, ensure pacman will not reinstall them by adding the following to the [options] section of /etc/pacman.conf:

  NoExtract = usr/lib/initcpio/post/sbctl
  NoExtract = usr/share/libalpm/hooks/zz-sbctl.hook
  

  (Note that the paths given to NoExtract do not start with a leading slash.)

  • EDIT: On further consideration, it may be necessary to keep zz-sbctl.hook around if you have other EFIs to sign. This hook just runs sbctl sign-all -g, so it should just re-sign the UKI from /boot for placement in /efi, which shouldn't cause any problems other than redundant CPU cycles.

• Run sudo mkinitcpio -p linux to regenerate the UKI. An unsigned copy of the UKI will be placed at /boot/arch-linux.efi, and another copy signed for Secure Boot will be placed at /efi/EFI/Linux/arch-linux.efi.

• Afterwards, whenever a package update triggers mkinitcpio's pacman hook, mkinitcpio will run, creating & signing a new UKI.

• If the kernel configuration is ever changed manually (e.g., if /etc/kernel/cmdline is edited), rebuild & sign the UKI by running sudo mkinitcpio -p linux again.

Thoughts?