From 55ad2df87ff6e02dc470ee7adf261fdda613d197 Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Mon, 5 Oct 2026 05:33:43 +0000
Subject: [PATCH] chore: don't fetch ublue-os secureboot key (#104)

We already have this on the image, there is no need to fetch it here
again, if the keys are rotated/don't match what is
present on the booted image then we have a problem.

Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
---
 iso_files/build.sh                  | 3 ++-
 iso_files/configure_iso_anaconda.sh | 6 +-----
 iso_files/smoke-tests.sh            | 7 +++++++
 3 files changed, 10 insertions(+), 6 deletions(-)
 create mode 100755 iso_files/smoke-tests.sh

diff --git a/iso_files/build.sh b/iso_files/build.sh
index 4854538..d72e856 100755
--- a/iso_files/build.sh
+++ b/iso_files/build.sh
@@ -71,7 +71,8 @@ bash \
   "$SCRIPT_DIR/flatpak-mount-workaround.sh" && \
   "$SCRIPT_DIR/plasma-tweaks.sh" && \
   "$SCRIPT_DIR/workarounds.sh" && \
-  "$SCRIPT_DIR/configure_iso_anaconda.sh"
+  "$SCRIPT_DIR/configure_iso_anaconda.sh" && \
+  "$SCRIPT_DIR/smoke-tests.sh"
 
 # image-builder needs gcdx64.efi / grub modules
 _arch=$(uname -m)
diff --git a/iso_files/configure_iso_anaconda.sh b/iso_files/configure_iso_anaconda.sh
index 2a4503b..80b4c32 100755
--- a/iso_files/configure_iso_anaconda.sh
+++ b/iso_files/configure_iso_anaconda.sh
@@ -88,17 +88,13 @@ sync
 %end
 EOF
 
-# Fetch the Secureboot Public Key
-sbkey='https://github.com/ublue-os/akmods/raw/main/certs/public_key.der'
-curl --retry 15 -Lo /etc/sb_pubkey.der "$sbkey"
-
 # Enroll Secureboot Key
 tee /usr/share/anaconda/post-scripts/secureboot-enroll-key.ks <<'EOF'
 %post --erroronfail --nochroot
 set -oue pipefail
 
 readonly ENROLLMENT_PASSWORD="universalblue"
-readonly SECUREBOOT_KEY="/etc/sb_pubkey.der"
+readonly SECUREBOOT_KEY="/etc/pki/akmods/certs/akmods-ublue.der"
 
 if [[ ! -d "/sys/firmware/efi" ]]; then
     echo "EFI mode not detected. Skipping key enrollment."
diff --git a/iso_files/smoke-tests.sh b/iso_files/smoke-tests.sh
new file mode 100755
index 0000000..fa56c10
--- /dev/null
+++ b/iso_files/smoke-tests.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -eoux pipefail
+
+# secureboot key that is enrolled on first-boot, we already have a test for
+# kernel on the image build
+stat /etc/pki/akmods/certs/akmods-ublue.der