diff --git a/README.md b/README.md index 3fd4fee..8ca51e0 100644 --- a/README.md +++ b/README.md @@ -90,21 +90,6 @@ sudo ksigner status Edit `/etc/ksigner/ksigner.conf` to customize behavior ```conf -# Key lifetime in days (default: 100 years) -KEY_LIFETIME_DAYS=$((365 * 100)) - -# Directory paths for keys -KEY_PUB_DIR="/etc/pki/sbsign/certs/" -KEY_PRIV_DIR="/etc/pki/sbsign/private/" - -# Key filenames -KEY_PUB="MOK.pem" -KEY_PRIV="MOK.priv" -KEY_DER="MOK.der" - -# Log file -LOG_FILE="/var/log/ksigner.log" - # Automatically sign kernels when they are installed # AUTO_SIGN=true ``` diff --git a/docs/ksigner.8.in b/docs/ksigner.8.in index f6e9106..81510db 100644 --- a/docs/ksigner.8.in +++ b/docs/ksigner.8.in @@ -67,11 +67,6 @@ Kernel update hook script for automatic signing. .SH CONFIGURATION The behavior of ksigner can be customized through the configuration file .IR /etc/ksigner/ksigner.conf . -Key configuration options include: - -.TP -.B KEY_LIFETIME_DAYS -Number of days the signing keys should remain valid (default: 36500, approximately 100 years). .TP .B AUTO_SIGN @@ -114,10 +109,6 @@ through a post-transaction hook. This feature is controlled by the .B AUTO_SIGN setting in the configuration file. -When automatic signing is enabled, kernels are signed immediately after installation -via the package manager. All signing operations are logged to -.IR /var/log/ksigner.log . - Note: Automatic signing requires that signing keys have been set up previously using .B ksigner setup and that the MOK has been enrolled. diff --git a/src/ksigner.conf b/src/ksigner.conf index 53f8fec..e354629 100644 --- a/src/ksigner.conf +++ b/src/ksigner.conf @@ -1,21 +1,6 @@ # Configuration file for ksigner # This file is sourced by the ksigner script -# Key lifetime in days (default: 100 years) -KEY_LIFETIME_DAYS=$((365 * 100)) - -# Directory paths for keys -KEY_PUB_DIR="/etc/pki/sbsign/certs/" -KEY_PRIV_DIR="/etc/pki/sbsign/private/" - -# Key filenames -KEY_PUB="MOK.pem" -KEY_PRIV="MOK.priv" -KEY_DER="MOK.der" - -# Log file -LOG_FILE="/var/log/ksigner.log" - # Automatic kernel signing via DNF post-transaction hook # Uncomment the following line to enable # AUTO_SIGN=true diff --git a/src/ksigner.in b/src/ksigner.in index a0d0622..bfda0f5 100644 --- a/src/ksigner.in +++ b/src/ksigner.in @@ -9,13 +9,17 @@ if [[ -f "$CONFIG_FILE" ]]; then source "$CONFIG_FILE" fi -# Default configuration values (can be overridden in config file) -KEY_LIFETIME_DAYS=${KEY_LIFETIME_DAYS:-$((365 * 100))} -KEY_PUB_DIR=${KEY_PUB_DIR:-/etc/pki/sbsign/certs/} -KEY_PUB=${KEY_PUB:-MOK.pem} -KEY_PRIV_DIR=${KEY_PRIV_DIR:-/etc/pki/sbsign/private/} -KEY_PRIV=${KEY_PRIV:-MOK.priv} -KEY_DER=${KEY_DER:-MOK.der} +# Key lifetime in days (default: 100 years) +KEY_LIFETIME_DAYS=$((365 * 100)) + +# Directory paths for keys +KEY_PUB_DIR="/etc/pki/sbsign/certs/" +KEY_PRIV_DIR="/etc/pki/sbsign/private/" + +# Key filenames +KEY_PUB="MOK.pem" +KEY_PRIV="MOK.priv" +KEY_DER="MOK.der" REQUIRED_BINARIES=( "openssl"