bash-stuff/install-grub-security.sh

#!/bin/bash
echo "[+] Installing GRUB 2 Security...";
echo "[i] Use --force to regenerate the signing key; clears ALL root's GPG keys!"
echo "[?] WARNING Make sure the current GRUB version does not have any bugs with gpg before installing, use CTRL+C to quit, enter to continue:";
read;
sudo cp bin/* /bin/ -f;
sudo cp initramfs-tools-hooks/* /etc/initramfs-tools/hooks/ -f;
sudo cp local-sbin/* /usr/local/sbin/ -f;
sudo cp kernel-hooks/* /etc/kernel/ -fr;
sudo cp lib-systemd-system-sleep/* /usr/lib/systemd/system-sleep/ -f;
sudo 7za x -o/etc grub.d.my.7z -y;
sudo chmod +x /etc/grub.d/*;
sudo cp sbat /root/sbat -f;
sudo cp stop_timeout.conf /etc/systemd/system.conf.d/60_custom.conf -f;
sudo systemctl daemon-reload;
if [[ "$1" == "--force" ]]; then
  echo "[?] WARNING Clearing previous gpg keys in root, use CTRL+C to quit, enter to continue:";
  read;
  sudo rm -f /root/pubkey;
  sudo rm -rf /root/.gnupg;
fi;
if sudo [ ! -f /root/pubkey ]; then
  sudo gpg --batch --passphrase '' --quick-gen-key root@localhost rsa3072 default;
  sudo gpg --export -o /root/pubkey;
fi;
sudo cp /root/pubkey /boot/pubkey -f;
sudo cp gpg.conf /root/.gnupg/gpg.conf -f;
sudo cp gpg-agent.conf /root/.gnupg/gpg-agent.conf -f;
sudo grub-update;
echo "[+] Complete!";