...

1 files changed, 0 insertions, 36 deletions

diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index aae167e..6eca320 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -48,13 +48,6 @@ in
         default = 0;
         description = "Index of the default boot entry";
       };
-      signing = {
-        enable = lib.mkEnableOption "GPG signing for Libreboot/GRUB";
-        keyId = lib.mkOption {
-          type = lib.types.str;
-          description = "The GPG Key ID used to sign the boot files";
-        };
-      };
     };
 
     luks.enable = lib.mkEnableOption "LUKS encryption support";
@@ -104,36 +97,7 @@ in
         default = cfg.grub.defaultEntry;
         enableCryptodisk = cfg.luks.enable;
         copyKernels = true;
-
-        extraConfig = lib.mkIf cfg.grub.signing.enable ''
-          set check_signatures=enforce
-          terminal_input console
-          terminal_output console
-        '';
-
-        extraInstallCommands = lib.mkIf cfg.grub.signing.enable ''
-          echo "Signing with keys from ${gpgHome}"
-
-          SIGN_CMD="${pkgs.gnupg}/bin/gpg --homedir ${gpgHome} --detach-sign --batch --yes --default-key ${cfg.grub.signing.keyId}"
-
-          $SIGN_CMD /boot/grub/grub.cfg
-
-          for f in /boot/nixos/*; do
-            if [[ "$f" != *.sig ]]; then
-              $SIGN_CMD "$f"
-            fi
-          done
-        '';
       };
-      environment.systemPackages = lib.optional cfg.grub.signing.enable pkgs.gnupg;
     })
-    {
-      assertions = [
-        {
-          assertion = cfg.grub.signing.enable -> cfg.grub.signing.keyId != "";
-          message = "Bootloader signing is enabled but os.core.bootloader.grub.signing.keyId is not set.";
-        }
-      ];
-    }
   ];
 }