Secure Boot on Arch Linux with sbctl changes

This is mostly to just help out other folks that might run into the same thing. If you had followed the instructions in the Arch wiki to setup Secure Boot with your own keys using the sbctl method and then also set up UKI builds for mkinitcpio using the sbctl method for verification, you likely have a post-hook in mkinitcpio to auto-sign the kernels it builds.

Recently, there was an sbctl update that required running a command to update its configuration to the latest version. After doing so, my builds for mkinitcpio failed autosigning due to the contents of /usr/share/secureboot/ being deleted. I validated though that sbctl verify and sbctl sign still worked as expected. I changed the post-hook to contain the following and I see it is succesfully auto-signing kernels again.

#!/usr/bin/env bash

uki="$3"
[[ -n "$uki" ]] || exit 0

if ! sbctl verify "$uki" &>/dev/null; then
	sbctl sign -s "$uki"
fi

Previously this script, as listed in the Arch wiki, calls sbverify and sbsign via explicit references to the filesystem path for the public and private keys in your keypair for Secure Boot. With those keys no longer present in the same location on the filesystem, but sbctl still able to see, interact, and reference with those keys in another location, changing this to use sbctl directly works.

Hope this helps somebody else that runs into the same issue.

2 Likes