@@ -204,6 +204,7 @@ function check_variables() {
204204 check_variables_value " HOOKS" " $HOOKS "
205205 check_variables_boolean " UKI" " $UKI "
206206 check_variables_list " BOOTLOADER" " $BOOTLOADER " " auto grub refind systemd efistub" " true" " true"
207+ check_variables_boolean " SECURE_BOOT" " $SECURE_BOOT "
207208 check_variables_list " CUSTOM_SHELL" " $CUSTOM_SHELL " " bash zsh dash fish" " true" " true"
208209 check_variables_list " DESKTOP_ENVIRONMENT" " $DESKTOP_ENVIRONMENT " " gnome kde xfce mate cinnamon lxde i3-wm i3-gaps deepin budgie bspwm awesome qtile openbox leftwm dusk" " false" " true"
209210 check_variables_list " DISPLAY_MANAGER" " $DISPLAY_MANAGER " " auto gdm sddm lightdm lxdm" " true" " true"
@@ -316,6 +317,10 @@ function check_facts() {
316317 if [ " $BIOS_TYPE " == " bios" ; then
317318 check_variables_list " BOOTLOADER" " $BOOTLOADER " " grub" " true" " true"
318319 fi
320+
321+ if [ " $SECURE_BOOT " == " true" ; then
322+ check_variables_list " BOOTLOADER" " $BOOTLOADER " " grub refind systemd" " true" " true"
323+ fi
319324}
320325
321326function prepare() {
@@ -802,7 +807,7 @@ function mkinitcpio_configuration() {
802807 fi
803808
804809 if [ " $UKI " == " true" ; then
805- mkdir -p " ${MNT_DIR} $ESP_DIRECTORY /EFI/linux"
810+ mkdir -p " ${MNT_DIR}${ ESP_DIRECTORY} /EFI/linux"
806811
807812 mkinitcpio_preset " linux"
808813 if [ -n " $KERNELS " ; then
@@ -1140,9 +1145,9 @@ ALL_microcode=(/boot/*-ucode.img)
11401145
11411146PRESETS=('default' 'fallback')
11421147
1143- default_uki="$ESP_DIRECTORY /EFI/linux/archlinux-$KERNEL .efi"
1148+ default_uki="${ ESP_DIRECTORY} /EFI/linux/archlinux-$KERNEL .efi"
11441149
1145- fallback_uki="$ESP_DIRECTORY /EFI/linux/archlinux-$KERNEL -fallback.efi"
1150+ fallback_uki="${ ESP_DIRECTORY} /EFI/linux/archlinux-$KERNEL -fallback.efi"
11461151fallback_options="-S autodetect"
11471152EOT
11481153}
@@ -1229,6 +1234,15 @@ function bootloader() {
12291234
12301235 CMDLINE_LINUX=$( trim_variable " $CMDLINE_LINUX " )
12311236
1237+ if [ " $SECURE_BOOT " == " true" ; then
1238+ curl --output PreLoader.efi https://blog.hansenpartnership.com/wp-uploads/2013/PreLoader.efi
1239+ curl --output HashTool.efi https://blog.hansenpartnership.com/wp-uploads/2013/HashTool.efi
1240+ md5sum PreLoader.efi > PreLoader.efi.md5
1241+ md5sum HashTool.efi > HashTool.efi.md5
1242+ echo " 4f7a4f566781869d252a09dc84923a82 PreLoader.efi" | md5sum -c -
1243+ echo " 45639d23aa5f2a394b03a65fc732acf2 HashTool.efi" | md5sum -c -
1244+ fi
1245+
12321246 case " $BOOTLOADER " in
12331247 " grub"
12341248 bootloader_grub
@@ -1265,21 +1279,26 @@ function bootloader_grub() {
12651279 echo " "
12661280 echo " # alis"
12671281 echo " GRUB_DISABLE_SUBMENU=y"
1268- }>> " ${MNT_DIR} "
1282+ }>> " ${MNT_DIR} "
12691283
12701284 if [ " $BIOS_TYPE " == " uefi" ; then
12711285 pacman_install " efibootmgr"
1272- arch-chroot " ${MNT_DIR} " " $ESP_DIRECTORY "
1273- # arch-chroot "${MNT_DIR}" efibootmgr --create --disk $DEVICE --part $PARTITION_BOOT_NUMBER --loader /EFI/grub/grubx64.efi --label "GRUB Boot Manager" --verbose
1286+ arch-chroot " ${MNT_DIR} " " ${ESP_DIRECTORY} "
12741287 fi
12751288 if [ " $BIOS_TYPE " == " bios" ; then
12761289 arch-chroot " ${MNT_DIR} " " $DEVICE "
12771290 fi
12781291
1279- arch-chroot " ${MNT_DIR} " " $BOOT_DIRECTORY /grub/grub.cfg"
1292+ arch-chroot " ${MNT_DIR} " " ${BOOT_DIRECTORY} /grub/grub.cfg"
1293+
1294+ if [ " $SECURE_BOOT " == " true" ; then
1295+ cp {PreLoader,HashTool}.efi " ${MNT_DIR}${ESP_DIRECTORY} /EFI/grub"
1296+ cp " ${ESP_DIRECTORY} /EFI/grub/grubx64.efi" " ${MNT_DIR}${ESP_DIRECTORY} /EFI/systemd/loader.efi"
1297+ arch-chroot " ${MNT_DIR} " " $DEVICE " " Arch Linux (PreLoader)" " /EFI/grub/PreLoader.efi"
1298+ fi
12801299
12811300 if [ " $VIRTUALBOX " == " true" ; then
1282- echo -n " \EFI\grub\grubx64.efi" > " ${MNT_DIR} $ESP_DIRECTORY /startup.nsh"
1301+ echo -n " \EFI\grub\grubx64.efi" > " ${MNT_DIR}${ ESP_DIRECTORY} /startup.nsh"
12831302 fi
12841303}
12851304
@@ -1288,9 +1307,15 @@ function bootloader_refind() {
12881307 arch-chroot " ${MNT_DIR} "
12891308
12901309 arch-chroot " ${MNT_DIR} "
1291- arch-chroot " ${MNT_DIR} " ' s/^timeout.*/timeout 5/' " $ESP_DIRECTORY /EFI/refind/refind.conf"
1292- arch-chroot " ${MNT_DIR} " ' s/^#scan_all_linux_kernels.*/scan_all_linux_kernels false/' " $ESP_DIRECTORY /EFI/refind/refind.conf"
1293- # arch-chroot "${MNT_DIR}" sed -i 's/^#default_selection "+,bzImage,vmlinuz"/default_selection "+,bzImage,vmlinuz"/' "$ESP_DIRECTORY/EFI/refind/refind.conf"
1310+ arch-chroot " ${MNT_DIR} " ' s/^timeout.*/timeout 5/' " ${ESP_DIRECTORY} /EFI/refind/refind.conf"
1311+ arch-chroot " ${MNT_DIR} " ' s/^#scan_all_linux_kernels.*/scan_all_linux_kernels false/' " ${ESP_DIRECTORY} /EFI/refind/refind.conf"
1312+ # arch-chroot "${MNT_DIR}" sed -i 's/^#default_selection "+,bzImage,vmlinuz"/default_selection "+,bzImage,vmlinuz"/' "${ESP_DIRECTORY}/EFI/refind/refind.conf"
1313+
1314+ if [ " $SECURE_BOOT " == " true" ; then
1315+ cp {PreLoader,HashTool}.efi " ${ESP_DIRECTORY} /EFI/refind"
1316+ cp " ${ESP_DIRECTORY} /EFI/refind/refind_x64.efi" " ${MNT_DIR}${ESP_DIRECTORY} /EFI/refind/loader.efi"
1317+ arch-chroot " ${MNT_DIR} " " $DEVICE " " Arch Linux (PreLoader)" " /EFI/refind/PreLoader.efi"
1318+ fi
12941319
12951320 if [ " $UKI " == " false" ; then
12961321 bootloader_refind_entry " linux"
@@ -1329,6 +1354,12 @@ When = PostTransaction
13291354Exec = /usr/bin/systemctl restart systemd-boot-update.service
13301355EOT
13311356
1357+ if [ " $SECURE_BOOT " == " true" ; then
1358+ cp {PreLoader,HashTool}.efi " ${ESP_DIRECTORY} /EFI/systemd"
1359+ cp " ${ESP_DIRECTORY} /EFI/systemd/systemd-bootx64.efi" " ${MNT_DIR}${ESP_DIRECTORY} /EFI/systemd/loader.efi"
1360+ arch-chroot " ${MNT_DIR} " " $DEVICE " " Arch Linux (PreLoader)" " /EFI/systemd/PreLoader.efi"
1361+ fi
1362+
13321363 if [ " $UKI " == " true" ; then
13331364 cat << EOT > "${MNT_DIR}${ESP_DIRECTORY} /loader/loader.conf"
13341365# alis
@@ -1343,7 +1374,7 @@ default archlinux.conf
13431374editor 0
13441375EOT
13451376
1346- arch-chroot " ${MNT_DIR} " " $ESP_DIRECTORY /loader/entries/"
1377+ arch-chroot " ${MNT_DIR} " " ${ ESP_DIRECTORY} /loader/entries/"
13471378
13481379 bootloader_systemd_entry " linux"
13491380 if [ -n " $KERNELS " ; then
@@ -1433,15 +1464,15 @@ function bootloader_efistub_entry() {
14331464 local MICROCODE=" "
14341465
14351466 if [ " $UKI " == " true" ; then
1436- arch-chroot " ${MNT_DIR} " " $DEVICE " " Arch Linux ($KERNEL fallback)" " EFI\linux\archlinux-$KERNEL -fallback.efi"
1437- arch-chroot " ${MNT_DIR} " " $DEVICE " " Arch Linux ($KERNEL )" " EFI\linux\archlinux-$KERNEL .efi"
1467+ arch-chroot " ${MNT_DIR} " unicode -- disk " $DEVICE " " Arch Linux ($KERNEL fallback)" " EFI\linux\archlinux-$KERNEL -fallback.efi"
1468+ arch-chroot " ${MNT_DIR} " unicode -- disk " $DEVICE " " Arch Linux ($KERNEL )" " EFI\linux\archlinux-$KERNEL .efi"
14381469 else
14391470 if [ -n " $INITRD_MICROCODE " ; then
14401471 local MICROCODE=" initrd=\\ $INITRD_MICROCODE "
14411472 fi
14421473
1443- arch-chroot " ${MNT_DIR} " " $DEVICE " " Arch Linux ($KERNEL )" " $KERNEL " " $CMDLINE_LINUX $CMDLINE_LINUX_ROOT rw $MICROCODE initrd=\initramfs-$KERNEL .img"
1444- arch-chroot " ${MNT_DIR} " " $DEVICE " " Arch Linux ($KERNEL fallback)" " $KERNEL " " $CMDLINE_LINUX $CMDLINE_LINUX_ROOT rw $MICROCODE initrd=\initramfs-$KERNEL -fallback.img"
1474+ arch-chroot " ${MNT_DIR} " unicode -- disk " $DEVICE " " Arch Linux ($KERNEL )" " $KERNEL " " $CMDLINE_LINUX $CMDLINE_LINUX_ROOT rw $MICROCODE initrd=\initramfs-$KERNEL .img"
1475+ arch-chroot " ${MNT_DIR} " unicode -- disk " $DEVICE " " Arch Linux ($KERNEL fallback)" " $KERNEL " " $CMDLINE_LINUX $CMDLINE_LINUX_ROOT rw $MICROCODE initrd=\initramfs-$KERNEL -fallback.img"
14451476 fi
14461477}
14471478
0 commit comments