Suggestion: Only sign generated file in initcpio hook, use sign-all in a separate pacman hook about sbctl HOT 4 OPEN

In case user are using sbctl for generate uki:

#!/usr/bin/env bash

uki="$3"
if [[ -n $uki ]]; then
    /usr/bin/sbctl sign "$uki"
else
    /usr/bin/sbctl sign-all -g
fi

from sbctl.

Is there any reason to use sbctl for UKI generation when mkinitcpio already supports it? (afaict the options supported by sbctl and mkinitcpio for ukis are the same)

From the sbctl manpage:

Note that dracut(8) and mkinitcpio(8) supports unified kernel features, and they should be preferred over the sbctl implementation. It is mostly provided in the cases where this feature is not supported by the initramfs generator of the distribution.

from sbctl.

@m00nwtchr Maybe for ensuring the UKI image always been signed? But I just thought we can't leave the UKI generation feature in sbctl broken if this really get accepted.

Edit: found this already been implemented 4 months ago xd
https://github.com/Foxboron/sbctl/blob/8e0e68bc0959f4e86ffcde9e8fa3f0a1680bf06e/contrib/mkinitcpio/sbctl
wait for release then

from sbctl.

But I just thought we can't leave the UKI generation feature in sbctl broken if this really get accepted.

Fwiw, it's already "almost" broken as the ukify wrapper from systemd supports all the new features.

from sbctl.