Is there a solution for making Secure Boot work with Limine & Snapshots?

[naim]

@Zesko

As far as I know, Secure Boot doesn’t apply to these files, since they’re executed directly by Limine using the linux protocol, bypassing EFI’s chainloading and signature checks.

I have confirmed that this is true. I will move on to do the following:

1. Add Limine detection to sbctl-batch-sign. If detected, it will exit without doing anything
2. Add an additional entry in the Secure Boot setup wiki for Limine.

For (2), /boot/EFI/BOOT/BOOTX64.EFI still needs to be signed, otherwise you get a secure boot violation warning, although pressing continue will allow the user to boot because Limine itself is signed.

Another thing to note is that sbctl’s mkinitcpio hook will not work for Limine because Limine doesn’t create a mkinitcpio preset, making the latter confused and ends up signing the kernel image in /lib/modules instead of the one in /boot. @Zesko, what do you think of making something like kernel-install-mkinitcpio/usr/bin/gen-mkinitcpio-preset at main · 1Naim/kernel-install-mkinitcpio · GitHub? This will makes Limine and limine-mkinitcpio-hook play well with mkinitcpio and users can use mkinitcpio normally instead of using sudo limine-mkinitcpio.

edit: nvm, even with the custom preset the hook will still try to sign the wrong path, i just disabled it with a symlink to null