Conversation
Agent-Logs-Url: https://github.com/pyrotiger/secure-boot/sessions/fb9c1e08-3585-4418-bad9-496037fb8989 Co-authored-by: pyrotiger <65628850+pyrotiger@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pyrotiger
May 2, 2026 07:04
View session
|
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s Secure Boot automation for the Garuda Linux + GRUB workflow by modernizing the shell script, simplifying the pacman hook, and fixing repository-local documentation links. It fits the codebase’s purpose of providing a small, self-contained guide plus helper scripts for configuring Secure Boot.
Changes:
- Hardens
setup.shwith stricter bash options and revised logic for discovering/signing unsigned files and kernel images. - Replaces the hook’s broken glob-based signing command with
sbctl sign-all. - Fixes
README.mdlinks so they point to repo files instead of a developer’s local filesystem.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
setup.sh |
Updates the interactive setup flow’s error handling and file-signing logic. |
90-sbctl.hook |
Changes the pacman hook to use sbctl sign-all and refreshes the header comments. |
README.md |
Converts hardcoded local file:// links to relative repository links. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Use the smart verify | sed command from the guide | ||
| # Note: We use a loop for better visibility/handling | ||
| FILES_TO_SIGN=$(sudo sbctl verify | grep "✗" | awk '{print $2}') | ||
| mapfile -t FILES_TO_SIGN < <(sudo sbctl verify | awk '/✗/{print $2}' || true) |
| # Use the smart verify | sed command from the guide | ||
| # Note: We use a loop for better visibility/handling | ||
| FILES_TO_SIGN=$(sudo sbctl verify | grep "✗" | awk '{print $2}') | ||
| mapfile -t FILES_TO_SIGN < <(sudo sbctl verify | awk '/✗/{print $2}' || true) |
| # Note: sbctl often provides its own hooks, but this is for manual signing. | ||
|
|
||
| # Save to /etc/pacman.d/hooks/90-sbctl.hook | ||
| # Re-signs all enrolled EFI binaries after kernel or GRUB updates. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Several correctness and robustness issues in
setup.shand90-sbctl.hook, plus broken localfile://links in the README.setup.shset -e→set -euo pipefail(catches unset vars and pipeline failures)for file in $FILES_TO_SIGN→mapfile -tarray with proper quoting — handles paths with spaces|| truetosbctl verifypipeline; sbctl exits 1 when unsigned files exist, which killed the script underpipefailfind /boot/vmlinuz-*(shell glob, not a validfindinvocation) →find /boot -maxdepth 1 -name 'vmlinuz-*'withwhile IFS= read -r90-sbctl.hooksbctl sign -s /boot/vmlinuz-*expands to multiple args butsbctl signtakes exactly one file — replaced withsbctl sign-all, which re-signs all paths previously enrolled with-sREADME.mdfile:///home/pyro/Development/projects/secure-boot/...hardcoded local paths with relative links