This is mostly to just help out other folks that might run into the same thing. If you had followed the instructions in the Arch wiki to setup Secure Boot with your own keys using the sbctl
method and then also set up UKI builds for mkinitcpio
using the sbctl
method for verification, you likely have a post-hook in mkinitcpio
to auto-sign the kernels it builds.
Recently, there was an sbctl
update that required running a command to update its configuration to the latest version. After doing so, my builds for mkinitcpio
failed autosigning due to the contents of /usr/share/secureboot/
being deleted. I validated though that sbctl verify
and sbctl sign
still worked as expected. I changed the post-hook to contain the following and I see it is succesfully auto-signing kernels again.
#!/usr/bin/env bash
uki="$3"
[[ -n "$uki" ]] || exit 0
if ! sbctl verify "$uki" &>/dev/null; then
sbctl sign -s "$uki"
fi
Previously this script, as listed in the Arch wiki, calls sbverify
and sbsign
via explicit references to the filesystem path for the public and private keys in your keypair for Secure Boot. With those keys no longer present in the same location on the filesystem, but sbctl
still able to see, interact, and reference with those keys in another location, changing this to use sbctl
directly works.
Hope this helps somebody else that runs into the same issue.