containers/bootc
1
0
Fork 0
mirror of https://github.com/containers/bootc.git synced 2026-02-05 06:45:13 +01:00
Code Issues Activity

seal-uki: break apart args for comment clarity

Browse Source 
Signed-off-by: John Eckersberg <jeckersb@redhat.com>
This commit is contained in:
John Eckersberg
2026-02-03 11:48:08 -05:00
parent 0a757685ee
commit 534fb40b00
1 changed files with 18 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
contrib/packaging/seal-uki
View File

@@ -21,17 +21,23 @@ fi
mkdir -p "${output}" mkdir -p "${output}"
# Build the UKI using bootc container ukify # Baseline ukify options
# This computes the composefs digest, reads kargs from kargs.d, and invokes ukify ukifyargs=(--measure
# --json pretty
--output "${output}/${kver}.efi")
# Signing options, we use sbsign by default
ukifyargs+=(--signtool sbsign
--secureboot-private-key "${secrets}/secureboot_key"
--secureboot-certificate "${secrets}/secureboot_cert")
# Baseline container ukify options
containerukifyargs=(--rootfs "${target}")
# WORKAROUND: SELinux must be permissive for sealed UKI boot # WORKAROUND: SELinux must be permissive for sealed UKI boot
# See https://github.com/bootc-dev/bootc/issues/1826 # See https://github.com/bootc-dev/bootc/issues/1826
bootc container ukify --rootfs "${target}" \ containerukifyargs+=(--karg enforcing=0)
--karg enforcing=0 \
-- \ # Build the UKI using bootc container ukify
--signtool sbsign \ # This computes the composefs digest, reads kargs from kargs.d, and invokes ukify
--secureboot-private-key "${secrets}/secureboot_key" \ bootc container ukify "${containerukifyargs[@]}" -- "${ukifyargs[@]}"
--secureboot-certificate "${secrets}/secureboot_cert" \
--measure \
--json pretty \
--output "${output}/${kver}.efi"