[PATCH 6/6] kernel-build.eclass: respect SECUREBOOT_SIGN_TOOL when signing UKI

secureboot.eclass now has an optional SECUREBOOT_SIGN_TOOL
parameter. Pass this on to ukify to ensure the selected tool is used
to sign the generic UKI as well.

Signed-off-by: Nowa Ammerlaan <[email protected]>
---
 eclass/kernel-build.eclass | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/eclass/kernel-build.eclass b/eclass/kernel-build.eclass
index 66c32981dfef..740ef0681261 100644
--- a/eclass/kernel-build.eclass
+++ b/eclass/kernel-build.eclass
@@ -686,9 +686,14 @@ kernel-build_src_install() {
 						--signing-engine="pkcs11"
 					)
 				fi
+				# systemd-sbsign does not support --sign-kernel.
+				# Disable unconditionally since we know the kernel
+				# image is already signed always.
 				ukify_args+=(
 					--secureboot-private-key="${SECUREBOOT_SIGN_KEY}"
 					--secureboot-certificate="${SECUREBOOT_SIGN_CERT}"
+					--signtool="${SECUREBOOT_SIGN_TOOL}"
+					--no-sign-kernel
 				)
 			fi
 			if [[ -n ${MEASUREDBOOT_SIGN_KEY} ]]; then
-- 
2.54.0