mkarchiso.patch

--- mkarchiso	2026-02-04 23:50:10.914863568 +0100
+++ mkarchiso	2026-02-04 23:50:42.188306309 +0100
@@ -376,6 +376,16 @@
     fi
 
     _msg_info "Done! Packages installed successfully."
+
+    # sign the kernel
+    for kernel in "${pacstrap_dir}/boot/vmlinuz-"*; do
+        sbsign --key MOK.key --cert MOK.crt --output "$kernel" "$kernel"
+    done
+    # signing systemd-boot and shell once and for all
+    sbsign --key MOK.key --cert MOK.crt --output "${pacstrap_dir}/usr/lib/systemd/boot/efi/systemd-boot${uefi_arch[$arch],,}.efi" \
+        "${pacstrap_dir}/usr/lib/systemd/boot/efi/systemd-boot${uefi_arch[$arch],,}.efi"
+    sbsign --key MOK.key --cert MOK.crt --output "${pacstrap_dir}/usr/share/edk2-shell/${uefi_arch[$arch],,}/Shell_Full.efi" \
+        "${pacstrap_dir}/usr/share/edk2-shell/${uefi_arch[$arch],,}/Shell_Full.efi"
 }
 
 # Customize installation.
@@ -696,11 +706,18 @@
         --locales="en@quot" \
         --themes="" \
         --sbat=/usr/share/grub/sbat.csv \
-        --disable-shim-lock \
         -o "${work_dir}/BOOT${uefi_arch[$arch]}.EFI" "boot/grub/grub.cfg=${work_dir}/grub-embed.cfg"
+    sbsign --key MOK.key --cert MOK.crt --output "${work_dir}/BOOT${uefi_arch[$arch]}.EFI" "${work_dir}/BOOT${uefi_arch[$arch]}.EFI"
     # Add GRUB to the list of files used to calculate the required FAT image size.
     efiboot_files+=("${work_dir}/BOOT${uefi_arch[$arch]}.EFI"
                     "${pacstrap_dir}/usr/share/edk2-shell/${uefi_arch[$arch],,}/Shell_Full.efi")
+    if [[ "$arch" == 'x86_64' ]]; then
+        efiboot_files+=("${pacstrap_dir}/usr/share/shim-signed/shimx64.efi"
+                        "${pacstrap_dir}/usr/share/shim-signed/mmx64.efi")
+    fi
+    if [[ -f MOK.cer ]] ;then
+        efiboot_files+=(MOK.cer)
+    fi
 
     # Create IA32 EFI binary for mixed-mode booting on x86_64 systems with IA32 UEFI
     if [[ "$arch" == 'x86_64' ]]; then
@@ -724,8 +741,27 @@
     install -d -m 0755 -- "${isofs_dir}/EFI/BOOT"
 
     # Copy GRUB EFI binary to the default/fallback boot path
-    mcopy -i "${efibootimg}" "${work_dir}/BOOT${uefi_arch[$arch]}.EFI" "::/EFI/BOOT/BOOT${uefi_arch[$arch]}.EFI"
-    install -m 0644 -- "${work_dir}/BOOT${uefi_arch[$arch]}.EFI" "${isofs_dir}/EFI/BOOT/BOOT${uefi_arch[$arch]}.EFI"
+    if [[ "$arch" == 'x86_64' ]]; then
+        # Copy shim EFI binary to the default/fallback boot path
+        mcopy -i "${efibootimg}" \
+            "${pacstrap_dir}/usr/share/shim-signed/shimx64.efi" ::/EFI/BOOT/BOOTx64.EFI
+        install -m 0644 -- "${pacstrap_dir}/usr/share/shim-signed/shimx64.efi" "${isofs_dir}/EFI/BOOT/BOOTx64.EFI"
+        mcopy -i "${efibootimg}" \
+            "${pacstrap_dir}/usr/share/shim-signed/mmx64.efi" ::/EFI/BOOT/mmx64.efi
+        install -m 0644 -- "${pacstrap_dir}/usr/share/shim-signed/mmx64.efi" "${isofs_dir}/EFI/BOOT/mmx64.efi"
+        # Copy GRUB EFI binary as grubx64.efi chainloaded by shimx64.efi
+        mcopy -i "${efibootimg}" "${work_dir}/BOOT${uefi_arch[$arch]}.EFI" ::/EFI/BOOT/grubx64.efi
+        install -m 0644 -- "${work_dir}/BOOT${uefi_arch[$arch]}.EFI" "${isofs_dir}/EFI/BOOT/grubx64.efi"
+
+        # Copy MOK certificate
+        if [[ -f MOK.cer ]] ;then
+            mcopy -o -i "${efibootimg}" MOK.cer ::/EFI/MOK.cer
+            install -m 0644 -- "MOK.cer" "${isofs_dir}/EFI/MOK.cer"
+        fi
+    else
+        mcopy -i "${efibootimg}" "${work_dir}/BOOT${uefi_arch[$arch]}.EFI" "::/EFI/BOOT/BOOT${uefi_arch[$arch]}.EFI"
+        install -m 0644 -- "${work_dir}/BOOT${uefi_arch[$arch]}.EFI" "${isofs_dir}/EFI/BOOT/BOOT${uefi_arch[$arch]}.EFI"
+    fi
     # Set up mixed mode booting for x86_64 systems with IA32 UEFI
     if [[ "$arch" == 'x86_64' ]]; then
         mcopy -i "${efibootimg}" "${work_dir}/BOOTIA32.EFI" ::/EFI/BOOT/BOOTIA32.EFI
@@ -783,11 +819,26 @@
 _make_common_bootmode_uefi.systemd-boot_copy_files() {
     local target_arch="$1"
 
-    # Copy systemd-boot EFI binary to the default/fallback boot path
-    mcopy -i "${efibootimg}" \
-        "${pacstrap_dir}/usr/lib/systemd/boot/efi/systemd-boot${target_arch,,}.efi" "::/EFI/BOOT/BOOT${target_arch}.EFI"
-    install -m 0644 -- "${pacstrap_dir}/usr/lib/systemd/boot/efi/systemd-boot${target_arch,,}.efi" \
-        "${isofs_dir}/EFI/BOOT/BOOT${target_arch}.EFI"
+    if [[ "$target_arch" == 'x64' && "$arch" == 'x86_64' ]]; then
+        # Copy shim EFI binary to the default/fallback boot path
+        mcopy -i "${efibootimg}" \
+            "${pacstrap_dir}/usr/share/shim-signed/shimx64.efi" ::/EFI/BOOT/BOOTx64.EFI
+        install -m 0644 -- "${pacstrap_dir}/usr/share/shim-signed/shimx64.efi" "${isofs_dir}/EFI/BOOT/BOOTx64.EFI"
+        mcopy -i "${efibootimg}" \
+            "${pacstrap_dir}/usr/share/shim-signed/mmx64.efi" ::/EFI/BOOT/mmx64.efi
+        install -m 0644 -- "${pacstrap_dir}/usr/share/shim-signed/mmx64.efi" "${isofs_dir}/EFI/BOOT/mmx64.efi"
+        # Copy systemd-boot EFI binary as grubx64.efi chainloaded by shimx64.efi
+        mcopy -i "${efibootimg}" \
+            "${pacstrap_dir}/usr/lib/systemd/boot/efi/systemd-boot${target_arch,,}.efi" ::/EFI/BOOT/grubx64.efi
+        install -m 0644 -- "${pacstrap_dir}/usr/lib/systemd/boot/efi/systemd-boot${target_arch,,}.efi" \
+            "${isofs_dir}/EFI/BOOT/grubx64.efi"
+    else
+        # Copy systemd-boot EFI binary to the default/fallback boot path
+        mcopy -i "${efibootimg}" \
+            "${pacstrap_dir}/usr/lib/systemd/boot/efi/systemd-boot${target_arch,,}.efi" "::/EFI/BOOT/BOOT${target_arch}.EFI"
+        install -m 0644 -- "${pacstrap_dir}/usr/lib/systemd/boot/efi/systemd-boot${target_arch,,}.efi" \
+            "${isofs_dir}/EFI/BOOT/BOOT${target_arch}.EFI"
+    fi
 
     # edk2-shell based UEFI shell
     # shell*.efi is picked up automatically when on /
@@ -853,6 +904,10 @@
                     "${pacstrap_dir}/boot/vmlinuz-"*
                     "${pacstrap_dir}/boot/initramfs-"*".img"
                     "${_available_ucodes[@]}")
+    if [[ "$arch" == 'x86_64' ]]; then
+        efiboot_files+=("${pacstrap_dir}/usr/share/shim-signed/shimx64.efi"
+                        "${pacstrap_dir}/usr/share/shim-signed/mmx64.efi")
+    fi
 
     # Files specific to x86_64: IA32 UEFI binaries for mixed mode booting, memtest86+
     if [[ "$arch" == 'x86_64' ]]; then
@@ -861,6 +916,9 @@
                         "${pacstrap_dir}/boot/memtest86+/memtest.efi"
                         "${pacstrap_dir}/usr/share/licenses/spdx/GPL-2.0-only.txt")
     fi
+    if [[ -f MOK.cer ]] ;then
+        efiboot_files+=(MOK.cer)
+    fi
     # Create a FAT image for the EFI system partition
     _make_efibootimg
 
@@ -880,6 +938,12 @@
         _make_common_bootmode_uefi.systemd-boot_copy_files 'IA32'
     fi
 
+    # Copy MOK certificate
+    if [[ -f MOK.cer ]] ;then
+        mcopy -o -i "${efibootimg}" MOK.cer ::/EFI/MOK.cer
+        install -m 0644 -- "MOK.cer" "${isofs_dir}/EFI/MOK.cer"
+    fi
+
     # Copy kernel and initramfs to FAT image.
     # systemd-boot can only access files from the EFI system partition it was launched from.
     _run_once _make_boot_on_fat