chore: don't fetch ublue-os secureboot key (#104)

We already have this on the image, there is no need to fetch it here
again, if the keys are rotated/don't match what is
present on the booted image then we have a problem.

Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>

iso_files/build.sh

@@ -71,7 +71,8 @@ bash \
   "$SCRIPT_DIR/flatpak-mount-workaround.sh" && \
   "$SCRIPT_DIR/plasma-tweaks.sh" && \
   "$SCRIPT_DIR/workarounds.sh" && \
-  "$SCRIPT_DIR/configure_iso_anaconda.sh"
+  "$SCRIPT_DIR/configure_iso_anaconda.sh" && \
+  "$SCRIPT_DIR/smoke-tests.sh"
 
 # image-builder needs gcdx64.efi / grub modules
 _arch=$(uname -m)

iso_files/configure_iso_anaconda.sh

@@ -88,17 +88,13 @@ sync
 %end
 EOF
 
-# Fetch the Secureboot Public Key
-sbkey='https://github.com/ublue-os/akmods/raw/main/certs/public_key.der'
-curl --retry 15 -Lo /etc/sb_pubkey.der "$sbkey"
-
 # Enroll Secureboot Key
 tee /usr/share/anaconda/post-scripts/secureboot-enroll-key.ks <<'EOF'
 %post --erroronfail --nochroot
 set -oue pipefail
 
 readonly ENROLLMENT_PASSWORD="universalblue"
-readonly SECUREBOOT_KEY="/etc/sb_pubkey.der"
+readonly SECUREBOOT_KEY="/etc/pki/akmods/certs/akmods-ublue.der"
 
 if [[ ! -d "/sys/firmware/efi" ]]; then
     echo "EFI mode not detected. Skipping key enrollment."

iso_files/smoke-tests.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -eoux pipefail
+
+# secureboot key that is enrolled on first-boot, we already have a test for
+# kernel on the image build
+stat /etc/pki/akmods/certs/akmods-ublue.der