File kernel-cert-subpackage of Package kernel-source

Overview Repositories Revisions Requests Users Attributes Meta

File kernel-cert-subpackage of Package kernel-source (Revision b0eaae7d53939f121746007e31ec80b4)

Currently displaying revision b0eaae7d53939f121746007e31ec80b4 , Show latest

%package -n %{-n*}-ueficert
Summary: UEFI Secure Boot Certificate For Package %{-n*}-kmp
Group: System/Kernel
%description -n %{-n*}-ueficert
This package contains the UEFI Secure Boot certificate used to sign
modules in the %{-n*}-kmp packages.

# The scriptlets are reused in kernel-binary.spec.in by a sed script that
# stops at the next line that starts with a percent sign
%post -n %{-n*}-ueficert
mok_rc=0
if command -v mokutil >/dev/null; then
	# Only apply CA check on the kernel package certs (bsc#1173115)
	if [ %{defined _suse_kernel_module_subpackage} = 0 ] && mokutil -h | grep -q "ca-check"; then
		MOK_ARG="--ca-check"
	else
		MOK_ARG=""
	fi
	# XXX: Only call mokutil if UEFI and shim are used
	for cert in @CERTS@; do
		mokutil --import "$cert" --root-pw ${MOK_ARG}
		rc=$?
		if [ $rc != 0 ] ; then
			mok_rc=$rc
			echo "Failed to import $cert"
		fi
	done
fi

%preun -n %{-n*}-ueficert
mok_rc=0
if command -v mokutil >/dev/null; then
	for cert in @CERTS@; do
		ln "$cert" "$cert.delete"
		rc=$?
		[ $rc == 0 ] || mok_rc=$rc
	done
fi

%postun -n %{-n*}-ueficert
mok_rc=0
if command -v mokutil >/dev/null; then
	for cert in @CERTS@; do
		if ! test -e "$cert"; then
			mokutil --delete "$cert.delete" --root-pw
			rc=$?
			if [ $rc != 0 ] ; then
				mok_rc=$rc
				echo "Failed to delete $cert"
			fi
		fi
		rm "$cert.delete" || mok_rc=$?
	done
fi

%files -n %{-n*}-ueficert
%defattr(-, root, root)
%dir /etc/uefi
/etc/uefi/certs

Places

File kernel-cert-subpackage of Package kernel-source (Revision b0eaae7d53939f121746007e31ec80b4)

Places