diff options
Diffstat (limited to 'os/core/bootloader.nix')
| -rw-r--r-- | os/core/bootloader.nix | 36 |
1 files changed, 0 insertions, 36 deletions
diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix index aae167e..6eca320 100644 --- a/os/core/bootloader.nix +++ b/os/core/bootloader.nix @@ -48,13 +48,6 @@ in default = 0; description = "Index of the default boot entry"; }; - signing = { - enable = lib.mkEnableOption "GPG signing for Libreboot/GRUB"; - keyId = lib.mkOption { - type = lib.types.str; - description = "The GPG Key ID used to sign the boot files"; - }; - }; }; luks.enable = lib.mkEnableOption "LUKS encryption support"; @@ -104,36 +97,7 @@ in default = cfg.grub.defaultEntry; enableCryptodisk = cfg.luks.enable; copyKernels = true; - - extraConfig = lib.mkIf cfg.grub.signing.enable '' - set check_signatures=enforce - terminal_input console - terminal_output console - ''; - - extraInstallCommands = lib.mkIf cfg.grub.signing.enable '' - echo "Signing with keys from ${gpgHome}" - - SIGN_CMD="${pkgs.gnupg}/bin/gpg --homedir ${gpgHome} --detach-sign --batch --yes --default-key ${cfg.grub.signing.keyId}" - - $SIGN_CMD /boot/grub/grub.cfg - - for f in /boot/nixos/*; do - if [[ "$f" != *.sig ]]; then - $SIGN_CMD "$f" - fi - done - ''; }; - environment.systemPackages = lib.optional cfg.grub.signing.enable pkgs.gnupg; }) - { - assertions = [ - { - assertion = cfg.grub.signing.enable -> cfg.grub.signing.keyId != ""; - message = "Bootloader signing is enabled but os.core.bootloader.grub.signing.keyId is not set."; - } - ]; - } ]; } |