Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add option lanzaboote.generateKeysIfNotExist #384

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

add option lanzaboote.generateKeysIfNotExist #384

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fb92fdd
add option lanzaboote.generateKeysIfNotExist
kuflierl Jul 31, 2024
271c7b6
fix logic issue in shell script
kuflierl Jul 31, 2024
409c892
reformat description to match the template for mkEnableOption
kuflierl Aug 21, 2024
f8d7377
Merge branch 'master' into patch-1
kuflierl Oct 1, 2024
b2ef351
Merge branch 'nix-community:master' into patch-1
kuflierl Oct 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions nix/modules/lanzaboote.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@ in

enrollKeys = mkEnableOption "Automatic enrollment of the keys using sbctl";

generateKeysIfNotExist = mkEnableOption "autogeneration of the PKI bundle if it doesn't exist";

configurationLimit = mkOption {
default = config.boot.loader.systemd-boot.configurationLimit;
defaultText = "config.boot.loader.systemd-boot.configurationLimit";
Expand Down Expand Up @@ -123,6 +125,15 @@ in
boot.loader.external = {
enable = true;
installHook = pkgs.writeShellScript "bootinstall" ''
${optionalString cfg.generateKeysIfNotExist ''
if [ ! -f "${cfg.privateKeyFile}" ]; then
mkdir -p ${cfg.pkiBundle}
${sbctlWithPki}/bin/sbctl create-keys \
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
${sbctlWithPki}/bin/sbctl create-keys \
${getExe sbctlWithPki} create-keys \

Copy link
Contributor Author

@kuflierl kuflierl Aug 21, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After looking up lib.getExe and verifying that sbctl does provide mainProgram I do believe that your change makes sense.

I am unsure if I should forego the precedent coding style in this file. May need an extra PR to fix.
Opinions?

-d ${cfg.pkiBundle} \
-e ${cfg.pkiBundle}/keys
fi
''}

${optionalString cfg.enrollKeys ''
mkdir -p /tmp/pki
cp -r ${cfg.pkiBundle}/* /tmp/pki
Expand Down