fwupd stopped honouring the FWUPD_EFIAPPDIR environment variable in
https://github.com/fwupd/fwupd/pull/9846; the location is a compile-time
constant (`EFI_APP_LOCATION`) since then, so setting the variable on
fwupd.service had no effect.
Drop `RuntimeDirectory` from the signing unit too: the directory is now
created and populated by the fwupd module, and RuntimeDirectoryPreserve
defaults to `no`, so systemd removed it (together with the unsigned app)
whenever the unit stopped -- which `partOf = fwupd.service` makes happen
on every fwupd restart.
Cover the whole path in the limine secure boot test, which so far never
enabled fwupd: it now asserts that both the unsigned app and the signed
variant end up in /run/fwupd-efi.
Assisted-by: claude-code with claude-opus-5[1m]-high
There is not reason to build an extra variant of OVMF only to get Secure
Boot support. We can just use the already built OVMFFull. Since
useSecureBoot is now no-op, it is also removed.
Limine is actively and well maintained upstream, and I'm very happy I
could get that effort started in 2024. Since I'm no longer focusing on
Limine, I'm stepping back from maintaining this package.
Thanks to the upstream maintainers for their continued work. I'll
remain an active nixpkgs contributor in areas where I can provide
meaningful input.
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
An easier way to check if secureBoot is enabled is by running mokutil --sb-state
We have to do this way now because on systemd v258 `bootctl status` returns non 0 value if systemd-boot is not properly installed, which is to be expected when using Limine.
This patch adds a NixOS test for Limine on BIOS systems. It also fixes
some formatting in `nixos/lib/make-disk-image.nix`.
Signed-off-by: John Titor <50095635+JohnRTitor@users.noreply.github.com>
