99-sign-all.install

#!/usr/bin/bash

# openssl req -new -x509 -newkey rsa:2048 -sha256 -days 365 -subj "/CN=Platform Key" -keyout PK.key -out PK.pem -nodes
# openssl req -new -x509 -newkey rsa:2048 -sha256 -days 365 -subj "/CN=Key Exchange Key" -keyout KEK.key -out KEK.pem -nodes
# openssl req -new -x509 -newkey rsa:2048 -sha256 -days 365 -subj "/CN=Image Signing Key" -keyout ISK.key -out ISK.pem -nodes
# cert-to-efi-sig-list -g "$(uuidgen)" PK.pem PK.esl
# cert-to-efi-sig-list -g "$(uuidgen)" KEK.pem KEK.esl
# cert-to-efi-sig-list -g "$(uuidgen)" ISK.pem ISK.esl
# cp ISK.esl db.esl
# sign-efi-sig-list -k PK.key -c PK.pem PK PK.esl PK.auth
# sign-efi-sig-list -k PK.key -c PK.pem KEK KEK.esl KEK.auth
# sign-efi-sig-list -k KEK.key -c KEK.pem db db.esl db.auth
# sudo mkdir /etc/uefi-keys
# sudo cp ISK.key ISK.pem /etc/uefi-keys

# Copy this script to /etc/kernel/install.d/99-sign-all.install and `chmod +x` it

RANDOM_SEED="YOUR_SEED"
COMMAND="$1"
KERNEL_VERSION="$2"

function sign {
    sbsign --key /etc/uefi-keys/ISK.key --cert /etc/uefi-keys/ISK.pem --output "$1" "$1"
}

case "$COMMAND" in
    add)
        bootctl --path=/boot/efi update
        sign /boot/efi/$RANDOM_SEED/$KERNEL_VERSION/linux
        sign /boot/efi/EFI/systemd/systemd-bootx64.efi
        sign /boot/efi/EFI/BOOT/BOOTX64.EFI
        echo "$(date) | kernel version = $KERNEL_VERSION" >> /boot/sign-all.log
        ;;

    *)
        exit 0
esac