98-systemd-boot.hook

[Trigger]
Type = Package
Operation = Upgrade
Target = systemd

[Action]
Description = Updating systemd-boot
When = PostTransaction
Exec = /usr/bin/sh -c '/usr/bin/bootctl update && for f in $(/usr/bin/bootctl -p)/EFI/{BOOT/BOOTX64.EFI,systemd/systemd-bootx64.efi}; do /usr/bin/sbsign --key /root/secure-boot/db.key --cert /root/secure-boot/db.crt --output "$f" "$f"; done'

99-secure-boot.hook

[Trigger]
Operation = Install
Operation = Upgrade
Type = File
Target = boot/vmlinuz-*

[Action]
Description = Signing Kernel for SecureBoot
When = PostTransaction
Exec = /usr/bin/sh -c 'while read -r f; do if ! /usr/bin/sbverify --list "$f" 2>/dev/null | /usr/bin/grep -q "signature certificates"; then /usr/bin/sbsign --key /root/secure-boot/db.key --cert /root/secure-boot/db.crt --output "$f" "$f"; fi done'
Depends = sbsigntools
Depends = grep
NeedsTargets