Refactor secure boot script

This commit is contained in:
Manuel Thalmann 2022-11-17 22:30:03 +01:00
parent 24d2a42ba2
commit e9aaad4f70

View file

@ -5,11 +5,22 @@ then
sudo bash "$BASH_SOURCE"
else
# Create context directory
workingDirectory=$(pwd)
contextRoot=$(mktemp -d)
cd $contextRoot
workingDirectory="$(pwd)"
contextRoot="$(mktemp -d)"
packageName="shim.rpm"
cd "$contextRoot"
# Install Prerequisites
apt install -y wget rpm2cpio
# Download and Extract Package
wget https://kojipkgs.fedoraproject.org//vol/fedora_koji_archive02/packages/shim-signed/15/2/x86_64/shim-x64-15-2.x86_64.rpm -O "$packageName"
rpm2archive "$packageName"
tar -xvzf "$packageName.tgz"
rm -f "$packageName" "$packageName.tgz"
# Initialize variables
src="./boot/efi/EFI/fedora"
esp=/boot/efi
defaultBootDir=$esp/EFI/BOOT
microsoftBootDir=$esp/EFI/Microsoft/Boot
@ -18,27 +29,26 @@ else
systemdFullName=$esp$systemdDirName
systemdFile=$systemdFullName/systemd-bootx64.efi
loaderBaseName=loader.efi
systemdLoaderFile=$systemdFullName/$loaderBaseName
# Set up files
mv $defaultBootDir/BOOTx64.efi $defaultBootDir/grubx64.efi
cp "$src/shimx64.efi" $defaultBootDir/BOOTx64.efi
cp "$src/mmx64.efi" $defaultBootDir
# Install PreLoader
wget https://blog.hansenpartnership.com/wp-uploads/2013/HashTool.efi
wget https://blog.hansenpartnership.com/wp-uploads/2013/PreLoader.efi
# Add boot entries
efibootmgr --unicode --disk /dev/nvme0n1 --part 0 --create --label "Shim" --loader /EFI/BOOT/BOOTx64.efi
cp {HashTool,PreLoader}.efi $systemdFullName
cp $systemdFile $systemdLoaderFile
efibootmgr --unicode --disk /dev/nvme0n1 --part 0 --create --label "PreLoader" --loader $systemdDirName/PreLoader.efi
# Configure systemd-boot
{
echo "timeout 4"
} >> /boot/efi/loader/loader.conf
# Add fallbacks
cp ./HashTool.efi $defaultBootDir
cp $systemdFile $defaultBootDir/$loaderBaseName
cp ./PreLoader.efi $defaultBootDir/BOOTx64.EFI
{
echo "title MokManager"
echo "efi /EFI/BOOT/mmx64.efi"
} > /boot/efi/loader/entries/MokManager.efi
# Add Microsoft fallbacks
mkdir -p $microsoftBootDir
cp ./PreLoader.efi $microsoftBootDir/bootmgfw.efi
cp ./HashTool.efi $microsoftBootDir
cp $systemdFile $microsoftBootDir/$loaderBaseName
# Install surface MOK
apt install -y linux-surface-secureboot-mok
# Remove context directory
cd $workingDirectory