Skip to content

fix: correct dependency checks for efitools and sbsign#1

Open
Xapier14 wants to merge 1 commit into
schmayterling:mainfrom
Xapier14:main
Open

fix: correct dependency checks for efitools and sbsign#1
Xapier14 wants to merge 1 commit into
schmayterling:mainfrom
Xapier14:main

Conversation

@Xapier14

Copy link
Copy Markdown

Summary

  • Fixed a mismatched dependency check where efitools was being tested by looking for sbsign, which is provided by a completely separate package (sbsigntool/sbsigntools). The check now correctly tests for sign-efi-sig-list, which is the command actually provided by efitools.
  • Added a missing dependency check for sbsign (used when signing EFI binaries), which was left uncovered by the original check.
  • Extended check_and_install to accept optional per-manager package names (args 3–5 for apt/dnf/pacman), since sbsign ships under different package names across distros (sbsigntool on Debian/Ubuntu, sbsigntools on Fedora and Arch).

Problem

The original line check_and_install efitools sbsign was broken in two ways:

  1. It probed for sbsign to decide whether efitools was installed — but sbsign belongs to a different package entirely. A system with efitools but without sbsigntool would pass the check silently, then fail later when sign-efi-sig-list or cert-to-efi-sig-list was called.
  2. After fixing the efitools check, sbsign itself (called at the EFI binary signing step) had no check at all, meaning it could be missing on a fresh system with no clear error.

Package name reference

Command Debian/Ubuntu Fedora Arch
sign-efi-sig-list, cert-to-efi-sig-list efitools efitools efitools
sbsign sbsigntool sbsigntools sbsigntools

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant