sstallion · October 11, 2017 21:46 · sstallion · Oct 11, 2017
diff --git a/Makefile b/Makefile
 # Copyright (c) 2017 Steven Stallion
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
 # are met:
 # 1. Redistributions of source code must retain the above copyright
 #    notice, this list of conditions and the following disclaimer.
 # 2. Redistributions in binary form must reproduce the above copyright
 #    notice, this list of conditions and the following disclaimer in the
 #    documentation and/or other materials provided with the distribution.
 #
 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 # ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.

 CERT_DIR	?= /etc/pki/pesign
 CERT_NICKNAME	?= $(shell hostname)
 GRUB_FORMAT	?= x86_64-efi
 GRUB_IMAGE	?= grubx64.efi
 GRUB_PREFIX	?= /boot/efi/EFI/fedora

 # The default list of modules included by grub2.spec;
 # see: http://pkgs.fedoraproject.org/cgit/rpms/grub2.git/tree/grub2.spec
 define GRUB_MODULES
 all_video boot btrfs cat chain configfile echo efifwsetup efinet ext2 \
 fat font gfxmenu gfxterm gzio halt hfsplus iso9660 jpeg loadenv \
 loopback lvm mdraid09 mdraid1x minicmd normal part_apple part_msdos \
 part_gpt password_pbkdf2 png reboot search search_fs_uuid \
 search_fs_file search_label serial sleep syslinuxcfg test tftp video \
 xfs
 endef

 define GRUB_EXTRA_MODULES
 cryptodisk luks gcry_rijndael gcry_sha512 gfxterm_background gfxterm_menu
 endef

 .PHONY:	all clean enroll install

 all:	$(GRUB_IMAGE) $(GRUB_IMAGE)-signed

 clean:
 	rm -f $(GRUB_IMAGE) $(GRUB_IMAGE)-signed

 enroll:
 	$(eval TMP = $(shell mktemp))
 	certutil -L -d $(CERT_DIR) -n $(CERT_NICKNAME) -o $(TMP) -r
 	mokutil -i $(TMP)
 	rm -f $(TMP)

 install: $(GRUB_IMAGE)-signed
 	cp -f -v $< $(GRUB_PREFIX)/$(GRUB_IMAGE)

 $(GRUB_IMAGE):
 	grub2-mkimage -O $(GRUB_FORMAT) -p $(GRUB_PREFIX) -o $@ $(GRUB_MODULES) $(GRUB_EXTRA_MODULES)

 $(GRUB_IMAGE)-signed: $(GRUB_IMAGE)
 	pesign -i $< -o $@ -n $(CERT_DIR) -c $(CERT_NICKNAME) -s
	# Copyright (c) 2017 Steven Stallion
	# All rights reserved.
	#
	# Redistribution and use in source and binary forms, with or without
	# modification, are permitted provided that the following conditions
	# are met:
	# 1. Redistributions of source code must retain the above copyright
	# notice, this list of conditions and the following disclaimer.
	# 2. Redistributions in binary form must reproduce the above copyright
	# notice, this list of conditions and the following disclaimer in the
	# documentation and/or other materials provided with the distribution.
	#
	# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
	# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	# SUCH DAMAGE.

	CERT_DIR ?= /etc/pki/pesign
	CERT_NICKNAME ?= $(shell hostname)
	GRUB_FORMAT ?= x86_64-efi
	GRUB_IMAGE ?= grubx64.efi
	GRUB_PREFIX ?= /boot/efi/EFI/fedora

	# The default list of modules included by grub2.spec;
	# see: http://pkgs.fedoraproject.org/cgit/rpms/grub2.git/tree/grub2.spec
	define GRUB_MODULES
	all_video boot btrfs cat chain configfile echo efifwsetup efinet ext2 \
	fat font gfxmenu gfxterm gzio halt hfsplus iso9660 jpeg loadenv \
	loopback lvm mdraid09 mdraid1x minicmd normal part_apple part_msdos \
	part_gpt password_pbkdf2 png reboot search search_fs_uuid \
	search_fs_file search_label serial sleep syslinuxcfg test tftp video \
	xfs
	endef

	define GRUB_EXTRA_MODULES
	cryptodisk luks gcry_rijndael gcry_sha512 gfxterm_background gfxterm_menu
	endef

	.PHONY: all clean enroll install

	all: $(GRUB_IMAGE) $(GRUB_IMAGE)-signed

	clean:
	rm -f $(GRUB_IMAGE) $(GRUB_IMAGE)-signed

	enroll:
	$(eval TMP = $(shell mktemp))
	certutil -L -d $(CERT_DIR) -n $(CERT_NICKNAME) -o $(TMP) -r
	mokutil -i $(TMP)
	rm -f $(TMP)

	install: $(GRUB_IMAGE)-signed
	cp -f -v $< $(GRUB_PREFIX)/$(GRUB_IMAGE)

	$(GRUB_IMAGE):
	grub2-mkimage -O $(GRUB_FORMAT) -p $(GRUB_PREFIX) -o $@ $(GRUB_MODULES) $(GRUB_EXTRA_MODULES)

	$(GRUB_IMAGE)-signed: $(GRUB_IMAGE)
	pesign -i $< -o $@ -n $(CERT_DIR) -c $(CERT_NICKNAME) -s