Add checks for sbsiglist and sbvarsign when doing SB auto enrollment

systemd · Mar 21, 2024 · 8951254 · 8951254
1 parent c39d8a7
commit 8951254
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/mkosi/__init__.py b/mkosi/__init__.py
@@ -2644,6 +2644,10 @@ def check_tools(config: Config, verb: Verb) -> None:
                 reason="sign verity roothash signature with OpenSSL engine",
             )
 
+        if want_efi(config) and config.secure_boot and config.secure_boot_auto_enroll:
+            check_tool(config, "sbsiglist", reason="set up systemd-boot secure boot auto-enrollment")
+            check_tool(config, "sbvarsign", reason="set up systemd-boot secure boot auto-enrollment")
+
     if verb == Verb.boot:
         check_systemd_tool(config, "systemd-nspawn", version="254", reason="boot images")