/boot/EFI/memtest86/memtest.efi is not signed

[Kreyren]

Is there a way to make it sign memtest set through boot.loader.systemd-boot.memtest86.enable ?

[nikstur]

We would need to implement this in Lanzaboote. There currently is no out of the box way to do it.

[Kreyren]

We would need to implement this in Lanzaboote. There currently is no out of the box way to do it. -- @nikstur (#273 (comment))

lanzaboote/rust/tool/systemd/src/install.rs

Line 377 in f707a9b

if let Some(specialisation_name) = &generation.specialisation_name {

# Blind code, untested, meant to show the intention only
if let Some(specialisation_name) = &generation.specialisation_name {
    Ok(PathBuf::from(format!(
        "nixos-generation-{}-specialisation-{}-{}.efi",
        generation, specialisation_name, stub_input_hash
    )))
+ } else if let Some(specialisation_name) = "memtest.efi" {
+     Ok(PathBuf::from("memtest.efi"))
} else {
    Ok(PathBuf::from(format!(
        "nixos-generation-{}-{}.efi",
        generation, stub_input_hash
    )))
}

Is it this easy or does it need additional changes somewhere else? Would probably be better to add some kind of management in nix to make nixos configuration more manageable as not everyone might want to sign the memtest

[RaitoBezarius]

It would require more than that.