add kernel sign

etc/kernel/install.d/98-sbsign.install

@@ -0,0 +1,43 @@
+#!/bin/bash
+# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+# ex: ts=8 sw=4 sts=4 et filetype=sh
+
+COMMAND="$1"
+KERNEL_VERSION="$2"
+BOOT_DIR_ABS="$3"
+KERNEL_IMAGE="$4"
+
+if ! [[ $KERNEL_INSTALL_MACHINE_ID ]]; then
+    exit 0
+fi
+
+if ! [[ -d "$BOOT_DIR_ABS" ]]; then
+    exit 0
+fi
+
+MACHINE_ID=$KERNEL_INSTALL_MACHINE_ID
+
+BOOT_DIR="/$MACHINE_ID/$KERNEL_VERSION"
+BOOT_ROOT=${BOOT_DIR_ABS%$BOOT_DIR}
+
+LINUX="$BOOT_DIR_ABS/linux"
+
+if [[ $COMMAND == remove ]]; then
+    exit 0
+fi
+
+if ! [[ $COMMAND == add ]]; then
+    exit 1
+fi
+
+if ! [[ $KERNEL_IMAGE ]]; then
+    exit 1
+fi
+
+
+if [[ -f .config ]]; then
+    echo "sbsign $LINUX"
+    sbsign --key /etc/efikeys/db.key --cert /etc/efikeys/db.crt --output $LINUX $LINUX
+fi
+
+exit 0