From 779bd46fcfac0fc46d41fa58f25f59db60c491d5 Mon Sep 17 00:00:00 2001 From: Miquel Sabaté Solà Date: Fri, 27 Feb 2026 08:06:03 +0100 Subject: kbuild: automatically sign vmlinuz on 'freezeezy' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Miquel Sabaté Solà --- .config/kbuild/freezeezy/install.sh | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/.config/kbuild/freezeezy/install.sh b/.config/kbuild/freezeezy/install.sh index 2009bfa..4231b63 100644 --- a/.config/kbuild/freezeezy/install.sh +++ b/.config/kbuild/freezeezy/install.sh @@ -34,20 +34,33 @@ if [ ! -f /usr/sbin/btrfs ]; then exit 1 fi +if [ ! -f /usr/bin/sbsign ]; then + echo "kbuild (error): you need 'sbsign'." + exit 1 +fi + +if [ ! -f ../certs/dev_key.pem ]; then + echo "kbuild (error): you need your developer key to sign vmlinuz in '../certs/dev_key.pem'." + exit 1 +fi + ## # Before anything at all, create a snapshot. btrfs subvolume snapshot / /.snapshots/pre-kernel-$name ## -# Copy files into filesystem and generate initramfs. +# The actual install. make modules_install # NOTE: headers are not installed on purpose. -# Manual make install -cp arch/x86/boot/bzImage /boot/vmlinuz-$name + +# Manual make install: sign the compressed image and move files into /boot. +sbsign --key ../certs/dev_key.pem --cert ../certs/dev_key.pem arch/x86/boot/bzImage --output /boot/vmlinuz-$name cp .config /boot/config-$name cp System.map /boot/System.map-$name + +# Generate initramfs. dracut --kver=$name -f ## -- cgit v1.2.3