feat: add secureblue keys to .builtin_trusted_keys (close #19)

copr_script.sh

@@ -9,6 +9,9 @@ set -euxo pipefail
 build_dir="$(realpath ..)"
 readonly build_dir
 
+script_dir="$(pwd)"
+readonly script_dir
+
 git clone https://src.fedoraproject.org/rpms/kernel.git
 cd kernel
 git checkout f44
@@ -225,4 +228,11 @@ sed --sandbox -i \
   -e "s/^# define buildid .*/%define buildid .secureblue.${secureblue_buildid_version}/" \
   kernel.spec
 
+# Merge trusted-keys/* into secureblue-certs.pem. This gets appended to
+# certs/rhel.pem alongside Fedora's keys (see trusted-keys.patch), so they
+# all end up in CONFIG_SYSTEM_TRUSTED_KEYS and thus .builtin_trusted_keys.
+cat "${build_dir}"/trusted-keys/*.pem > secureblue-certs.pem
+
+git apply "${script_dir}"/patches/*.patch
+
 mv ./* "${build_dir}"

patches/trusted-keys.patch

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: Copyright 2026 The Secureblue Authors
+#
+# SPDX-License-Identifier: MIT
+
+diff --git a/kernel.spec b/kernel.spec
+index 2e03403..59594fe 100644
+--- a/kernel.spec
++++ b/kernel.spec
+@@ -1214,6 +1214,7 @@ Source3002: Patchlist.changelog
+ Source4000: README.rst
+ Source4001: rpminspect.yaml
+ Source4002: gating.yaml
++Source4010: secureblue-certs.pem
+
+ ## Patches needed for building this package
+
+@@ -2313,6 +2314,7 @@ cat secureboot.pem >> ../certs/rhel.pem
+
+ openssl x509 -inform der -in %{ima_ca_cert} -out imaca.pem
+ cat imaca.pem >> ../certs/rhel.pem
++cat %{SOURCE4010} >> ../certs/rhel.pem
+
+ for i in *.config; do
+   sed -i 's@CONFIG_SYSTEM_TRUSTED_KEYS=""@CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"@' $i

trusted-keys/secureblue db CA 2026.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDITCCAgmgAwIBAgIUKmVBhNiDt/LwiXlkFwVr2TvGgnQwDQYJKoZIhvcNAQEL
+BQAwIDEeMBwGA1UEAwwVc2VjdXJlYmx1ZSBkYiBDQSAyMDI2MB4XDTI2MDcwNzAw
+MDY1MVoXDTI2MDgwNjAwMDY1MVowIDEeMBwGA1UEAwwVc2VjdXJlYmx1ZSBkYiBD
+QSAyMDI2MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk6iuDMfRFteB
+rcu0GaDhibodHF/xfOPT2QyW5m2BlX2eG9QT/97uES/+NHgumkDlOIsLCQBzAPTt
+fcwwQ8+9ZIj8kdVLf5lbbKHvLC8cUyOy59Q6PLZhfoVBhm4IJUGmEltK6N+vRh32
+5p+LqqdLWCmbVC8ui1ddhXl6WVqUl0p05l069y757FJ6RqxIY0pTeoe/qs7Pulmk
+v+SUbby2nyo+WfRBRtdaddamRORm0N3MWXTtDoxc6Iu8D9nizK7WQTKEJEgYsMw4
+NPs+vrkIxdqeb+a9aCFvW+LzUotPwt6GrDSFAunoOCWEeWOhFzDsLSlXGhfWcLxl
+5NIrdIEc6QIDAQABo1MwUTAdBgNVHQ4EFgQUx91vbjPBwYiOs5cbqA05m6KkMwIw
+HwYDVR0jBBgwFoAUx91vbjPBwYiOs5cbqA05m6KkMwIwDwYDVR0TAQH/BAUwAwEB
+/zANBgkqhkiG9w0BAQsFAAOCAQEAbmIrm5MC0ZzDs41SAvi5HOr8GD1klcBWD3O5
+IvUSLn2pbI3aOxFEEBOt71qvQ1XmxF6OlUlwYxPGtpjdI/ZkVhn0bPFIKCHJib1o
+hkVT5Zw+K1QH9wlMbXsyRr06eqSua3Hg6Cq5bzbc4DecCQ9gA/3tH38QLdseI4kO
+0B72oU5vixC7xRbDiJ9zvZMnuqmZndon0XQOU9POMdnQPHytiXR6nZE9PBWxh+UP
+ShEpgqJnrmI/xBGwufYe2OAoGQ+oBD9hAayaMWdbGRJ9tTcal/3shQ7Uwpg/61wD
+nHfOcmMhspayH1cUp00m6MOId9UcVI0yyTJy2Yfv4BFkKBuuKA==
+-----END CERTIFICATE-----

trusted-keys/secureblue secureboot key.pem

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFkjCCA3qgAwIBAgIUXf9SP5fcCKafYbuO4D1v+8Tky8kwDQYJKoZIhvcNAQEL
+BQAwYzETMBEGA1UECgwKc2VjdXJlYmx1ZTEiMCAGA1UEAwwZc2VjdXJlYmx1ZSBz
+ZWN1cmVib290IGtleTEoMCYGCSqGSIb3DQEJARYZc2VjdXJlYmx1ZWFkbWluQHBy
+b3Rvbi5tZTAgFw0yNTAzMjYwMDI4MTBaGA8yMTI1MDMwMjAwMjgxMFowYzETMBEG
+A1UECgwKc2VjdXJlYmx1ZTEiMCAGA1UEAwwZc2VjdXJlYmx1ZSBzZWN1cmVib290
+IGtleTEoMCYGCSqGSIb3DQEJARYZc2VjdXJlYmx1ZWFkbWluQHByb3Rvbi5tZTCC
+AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL+gXkj+9/rRIrcv9kvOvQcC
+Av6s3+6oEq7tEXcy15SRjIiGOjklBYvNbP+Qtz77W6b7s6SW6AlE0179KWD1FZCS
+EswfwbAj1Cwiu5EM6vSpLlVqE4dwZx2shg+l3a+Uxsesezj8veS4GGJXImdsqqWW
+w5512zRl1Dstj1PvnsVrG/8/+ZawR09AulORVmhU4L3XwNiVm5pYlapjSqcJZTLw
+Y9Uc94xm6dm22ak0GTRFd/D8uAyny2CK+JM/iWCOseO3RplkPNsmeRC+oa29zhCg
+NnURzdO7Khi6Q+24TTRecU6QWhhBTHN8QgJkIctX4Zh0uktXFzDNH2wbneJXxiSq
+xWYl8L/TtypOGLQguHo/s+R4W3cnwoySKU54OtX3oLLdRY8SS99pC2PECdTUlYlG
+/YkV/ZbpH6Mh5cuTzhwzSbQEYPi80Iir9+ebsQ5S0eHWH2Rtnsjezd8sZ84BTZzs
+FLpjpjuakaYVTiTG83MnaKeir68QdQtnxbe3omHMMrjjoBPKv025wh8EWmZMpCkE
+4j0cLn1zOYYRNI9Tb5ITB83wEVOWh0t5r0cOv0Krm38vrcNvWph5s4F1q8zRD7dY
+Zho2mG0+XKmFsOoTl4/jZNfPc3/3IO6yPu/MR+E5rV554cAr6WtO2qVam7vi58HD
+hhZ1JnqBpzxMNpyOpqC/AgMBAAGjPDA6MAwGA1UdEwEB/wQCMAAwCwYDVR0PBAQD
+AgeAMB0GA1UdDgQWBBRQAikLHne+dfdWnS/BzLFxYvKA4TANBgkqhkiG9w0BAQsF
+AAOCAgEAFkua2MAV6ILd1/oadq4ma44YATqfbJyzeldkGIvPn0a3yrMg3CfxwELC
+/6/mjuY22an9PtVr+W4tMZKMcBiBnQ2Zf1Df4g6Yi1Piy/WYT0i6zEa4NCfmgq07
+f84p+PxIJ8ejFwT9igeDhp0svAOBRH3SLnhrzUy6T5FPAOxJw7ACses8vaLHdlNl
+/hvu9q+5AhXPs2yZzsNT2qG38MRaj2O6kvB6kNVo0nCp2p08MTBJE7qdh+QXcNiF
+bVLtdViyx5TM1412Fr1dHex7j/P2zzL1GUvJePoa7Kk+Ex1P3h5txgu5/fUfnzSe
+7VVU1s48g4wTYmZTScTWlGy+1yJ9cIE19lR1wH2pP2sHOrjN2T/RTH4DdQ1V2AX7
+Jvsh58iQeC4tYdaromZ4L7VDrps36NMDNV/0AbAbeIlU1XRnyrD/+sTtSwCg/88e
+8VttCWT3gBHzmuc/sqp8BB7LPW6gVF0xlqiWCndZi2HNWz6CuSYl87K2/VZWopIM
+dZjg68Dp9L07PkzEuvoBAL+KTVR6DuCpSoBJTmMfUb3Nbn7Hxs7MuIHmEOyFEpW5
+6ZdjIppr68SccV4lbhRTInbYIpXnMZhjPcm56Jdr6G5Yt1d9qlf0KnLCPAftWfl6
+y1J43H4xZP8EDfL1eTN/2/eSYhlCye5iARmuu1jCKPL8mf3YEe8=
+-----END CERTIFICATE-----