Lanzatool skips already existing files even if they are not signed about lanzaboote HOT 10 CLOSED

Yes, but for sd-boot it matters even on an "ignore" policy where we ignore old kernels and initrds

from lanzaboote.

#76 solved our issue with newer/malformed/unsiged systemd-boot binaries. It did not solve the issue with existing unsiged kernels.

from lanzaboote.

sd-boot is not signed by lanzatool if it already existed

from lanzaboote.

same for kernels or any file actually I think

from lanzaboote.

Related to #56 and #55.

from lanzaboote.

Can't we just verify signature of existing files and sign them too, instead of just signing only non-existing files?

from lanzaboote.

Can't we just verify signature of existing files and sign them too, instead of just signing only non-existing files?

Yes this is what is planned.

from lanzaboote.

#75 & Implementing a solution for #68 will fix this issue.

from lanzaboote.

Hit this and one more nix-collect-garbage -d and another rebuild solved this for me.

from lanzaboote.

Now that #75 is merged, the only issue left here is that the stub/UKI might not be signed and will not be resigned or overwritten. This, however, could only happen if the user manually removed the signature from one of them.

from lanzaboote.