bash-stuff/local-sbin/sign-boot

#!/bin/bash
if [ -f /run/signing ]; then
  echo "[-] Signing already in progress!";
fi;
/usr/bin/touch /run/signing;
echo "[*] Preparing to sign!";
#touch /dev/shm/sb-passpwd.txt;
#chown root:root /dev/shm/sb-passpwd.txt;
#chmod u=rw,g=,o= /dev/shm/sb-passpwd.txt;
#echo -n "Password: ";
#read -s pwd;
#echo -n "$pwd" > /dev/shm/sb-passpwd.txt;
echo "[-] BMOK Un-Signing...";
for i in $(/usr/bin/find /boot/grub -iname "*.efi" -type f -print)
do
  echo $i;
  /usr/bin/sbattach --remove $i;
done;
echo "[+] BMOK Signing...";
for i in $(/usr/bin/find /boot/grub -iname "*.efi" -type f -print)
do
  echo $i;
  /usr/bin/sbsign --key /cert/BMOK.priv --cert /cert/BMOK.pem $i --output $i;
done;
echo "[-] Un-Signing...";
#-iname "efi" -prune -o
for i in $(/usr/bin/find /boot -iname "*.sig" -type f -print)
do
  rm "$i";
done;
echo "[+] Signing...";
for i in $(/usr/bin/find /boot -iname "efi" -prune -o -iname "grubenv" -prune -o -iname "boot-tainted" -prune -o -type f -print)
do
  echo $i;
  /usr/bin/gpg --batch --detach-sign $i;
  #gpg -v --batch --detach-sign --passphrase-fd 0 $i < \
  #  /dev/shm/sb-passpwd.txt;
done;
for i in $(/usr/bin/find /boot/efi -iname "*.cfg" -type f -o -iname "*.efi" -type f -print)
do
  echo $i;
  /usr/bin/gpg --batch --detach-sign $i;
done;
#shred /dev/shm/sb-passpwd.txt;
/usr/bin/rm -f /run/signing;
echo "[*] Signing Complete!";