Trigger hook on changes to initramfs

[kohlerjl]

Thanks for a well written script to manage secure boot on Arch. It helped me a lot to setup on my own computer.

One potential issue I noticed is that any changes that trigger the mkinitcpio PostTransaction hook to rebuild initramfs-linux.img don't necessarily trigger this script to rebuild and sign the merged initramfs+kernel. To correct that, I have changed the Trigger on my pacman hook to include the same Targets as the hook that builds initramfs-linux.img:

Type = File
Target = boot/vmlinuz-linux
Target = boot/intel-ucode.img
Target = boot/initramfs-linux.img
Target = usr/lib/initcpio/*

[gdamjan]

Target = boot/initramfs-linux.img won't work since it's not part of any package.

Have you tried Target = usr/lib/initcpio/* ? does it work well for you?

[kohlerjl]

Ah, yes, it only triggered properly when I added Target = usr/lib/initcpio/*, which has worked well so far, but I haven't tested extensively. I did rename my secure boot hook to 99-secure-boot.hook, to make sure it ran after the mkinitcpio hook, which is named 90-linux.hook

[gdamjan]

I'll make these changes soon (already editied this repo).

The problem with the hooks as it is now, it only runs when the main kernel is updated. In the future, if Arch would move to kernel-install it would be possible to run secure-boot as a hook to it, and update the image for any kernel installed.