Hello, Thanks for the great project! Here are my package versions and `/etc/default/limine` for reference: ``` ❯ pacman -Qs limine local/limine 9.2.3-1 An advanced, portable, multiprotocol bootloader local/limine-dracut-support 1.16.1-1 Install kernel for Limine bootloader. local/limine-snapper-sync 1.9.2-1 The tool syncs Snapper snapshots with Limine bootloader ❯ cat /etc/default/limine File: /etc/default/limine TARGET_OS_NAME="arch-sway" KERNEL_CMDLINE[default]="rd.luks.name=daa28503-702f-4ab7-a151-9c39bf24895b=root root=/dev/mapper/root rw rootflags=subvol=arch-sway lsm=landlock,lockdown,yama,integrity,apparmor,bpf" SPACE_NUMBER=2 ENABLE_VERIFICATION=yes BACKUP_THRESHOLD=2 BOOT_ORDER="*zen, *hardened, *lts, Snapshots" ENABLE_SORT=no DRACUT_FALLBACK=no DRACUT_UKI=yes REGISTER_LIMINE_EFI=yes SET_LIMINE_AS_FALLBACK=yes FIND_BOOTLOADERS=yes ENABLE_ENROLL_LIMINE_CONFIG=yes MAX_SNAPSHOT_ENTRIES=6 LIMIT_USAGE_PERCENT=80 ESP_PATH="/efi" SNAPPER_CONFIG_NAME="root" ROOT_SUBVOLUME_PATH="/arch-sway" ROOT_SNAPSHOTS_PATH="/arch-sway/.snapshots" ENABLE_RSYNC_ASK=no AUTH_METHOD=run0 TERMINAL="footclient" TERMINAL_ARG="-e" SNAPSHOT_FORMAT_CHOICE=2 HASH_FUNCTION=blake3 NOTIFICATION_ICON="/usr/share/icons/hicolor/128x128/apps/LimineSnapperSync.png" COMMANDS_BEFORE_SAVE="limine-reset-enroll" COMMANDS_AFTER_SAVE="limine-enroll-config" ``` I'm having an issue with the signing hook, specifically with getting `/efi/EFI/Limine/limine_x64.efi` signed after certain updates or snapshot changes. Here is an example in the journal: ``` May 06 20:20:52 limine-snapper-watcher[14710]: Read the Limine config: /efi/limine.conf May 06 20:20:52 limine-snapper-watcher[14710]: Command succeeded: cp -f '/efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi' '/efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi_b3_1134f5cf5f19a6d8adb69c1ac3ef2c626111faa1292039fcdf807e9c42db5c78' May 06 20:20:52 limine-snapper-watcher[14710]: Command succeeded: cp -f '/efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-hardened.efi' '/efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-hardened.efi_b3_22344f2d447d7285b43433385d5de3dbc1b26cdbcb2192a24598fd1ceca7ba03' May 06 20:20:52 limine-snapper-watcher[14710]: Command succeeded: cp -f '/efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-lts.efi' '/efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-lts.efi_b3_daeb9cbb9f88b188a2eb1f910bfc707e508cc942463f3f38acc3a56d627bc3aa' May 06 20:20:52 limine-snapper-watcher[14710]: Saved successfully: /efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/snapshots.json May 06 20:20:52 limine-snapper-watcher[14710]: Saved successfully: /efi/limine.conf May 06 20:20:53 limine-snapper-watcher[14710]: Config file BLAKE2B successfully enrolled! May 06 20:20:53 limine-snapper-watcher[14710]: Error: Failed to sign the file '/efi/EFI/Limine/limine_x64.efi'. May 06 20:20:53 limine-snapper-watcher[14710]: Command failed: "limine-enroll-config" with exit code: 1 May 06 20:20:53 limine-snapper-sync[14872]: Command failed: limine-enroll-config with exit code: 1 ``` This is also reproducible by reinstalling certain packages, for example the kernel. ``` ❯ pacman -S linux-zen warning: linux-zen-6.14.5.zen1-1 is up to date -- reinstalling resolving dependencies... looking for conflicting packages... Package (1) Old Version New Version Net Change extra/linux-zen 6.14.5.zen1-1 6.14.5.zen1-1 0.00 MiB Total Installed Size: 144.42 MiB Net Upgrade Size: 0.00 MiB :: Proceed with installation? [Y/n] (1/1) checking keys in keyring [------------------------------------------------] 100% (1/1) checking package integrity [------------------------------------------------] 100% (1/1) loading package files [------------------------------------------------] 100% (1/1) checking for file conflicts [------------------------------------------------] 100% (1/1) checking available disk space [------------------------------------------------] 100% :: Running pre-transaction hooks... (1/2) Performing snapper pre snapshots for the following configurations... ==> root: 21 (2/2) Wait for limine-snapper-sync to finish before updating, installing or removing. :: Processing package changes... (1/1) reinstalling linux-zen [------------------------------------------------] 100% :: Running post-transaction hooks... (1/9) Arming ConditionNeedsUpdate... (2/9) Updating module dependencies... (3/9) Updating initramfs... Building UKI for linux-zen (6.14.5-zen1-1-zen) File '/efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi' signed successfully. Updated successfully: /efi/limine.conf UKI stored in: /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi Config file BLAKE2B successfully enrolled! Error: Failed to sign the file '/efi/EFI/Limine/limine_x64.efi'. (4/9) Keep the last cache and the currently installed. ==> no candidate packages found for pruning (5/9) Foreign/AUR package notification jellyfin-tui 1.1.3-1 squiid 1.3.0-1 (6/9) Orphaned package notification... => No orphans found. (7/9) Checking for .pacnew and .pacsave files... (8/9) Signing EFI binaries... Generating EFI bundles.... File has already been signed /efi/EFI/limine/limine_x64.bak failed signing /efi/EFI/limine/limine_x64.efi: incorrect digest File has already been signed /efi/EFI/BOOT/BOOTX64.EFI File has already been signed /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-hardened.efi File has already been signed /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-lts.efi File has already been signed /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi File has already been signed /efi/EFI/limine/BOOTX64.EFI error: command failed to execute correctly (9/9) Performing snapper post snapshots for the following configurations... ==> root: 22 ``` `sbctl` seems to get "stuck" after this, on the `incorrect digest` error. ``` ❯ sbctl verify Verifying file database and EFI images in /efi... ✓ /efi/EFI/limine/BOOTX64.EFI is signed ✓ /efi/EFI/limine/limine_x64.bak is signed incorrect digest ``` I found this potentially related open issue on the `sbctl` GitHub: https://github.com/Foxboron/sbctl/issues/408. I guess I'm not really sure if I understand the discussion though. `limine-update` fixes it, but it is not desirable to run this every time because it rebuilds all the UKIs. I discovered running `limine-reset-enroll` against the file it fails to sign also seems to fix it. ``` ❯ sbctl verify Verifying file database and EFI images in /efi... ✓ /efi/EFI/limine/BOOTX64.EFI is signed ✓ /efi/EFI/limine/limine_x64.bak is signed incorrect digest ❯ limine-reset-enroll /efi/EFI/limine/limine_x64.efi ❯ sbctl verify Verifying file database and EFI images in /efi... ✓ /efi/EFI/BOOT/BOOTX64.EFI is signed ✓ /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-hardened.efi is signed ✓ /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-lts.efi is signed ✓ /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi is signed ✓ /efi/EFI/limine/BOOTX64.EFI is signed ✓ /efi/EFI/limine/limine_x64.bak is signed ✓ /efi/EFI/limine/limine_x64.efi is signed ✓ /efi/EFI/Linux/d9236811b22040b8b15cd2d5ec0f4f77_linux-lts.efi is signed ✓ /efi/EFI/Linux/d9236811b22040b8b15cd2d5ec0f4f77_linux.efi is signed ✓ /efi/d9236811b22040b8b15cd2d5ec0f4f77/limine_history/d9236811b22040b8b15cd2d5ec0f4f77_linux-lts.efi_b3_282e341354b20ed216fa6c3a7b093004575fc74e3b6273e28ff96f0e78d95c04 is signed ✓ /efi/d9236811b22040b8b15cd2d5ec0f4f77/limine_history/d9236811b22040b8b15cd2d5ec0f4f77_linux.efi_b3_4f78b035f60a48aa8723d422f79b526f109c75d5a102c1f26bd90a98149ec283 is signed ✓ /efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-hardened.efi_b3_11235459aab0e0017e039e55b54d1712135f678dd5109bec4850ad7221413c81 is signed ✓ /efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-hardened.efi_b3_243814cf8146439f0873d9e703f943092925baee890fd882bd01237b7c20a48f is signed ✓ /efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-lts.efi_b3_0818d426ef45a6a78b63dad1bd337cfc6e45872414de14e51a7a56ccfd4b312c is signed ✓ /efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-lts.efi_b3_e744ca4ad88bc13fccbadd788827e0f9ac679933ed033e021f2f8e593328e91a is signed ✓ /efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi_b3_1161c9777ebff0f2426e43a389b6efde296fbd135bc483dc604b00d2e78f666c is signed ✓ /efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi_b3_4a7e46a034dab1fe4e983ab3fdcb524f21979f6a02af04819c9648e026fbab57 is signed ✓ /efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi_b3_673cf1cffb37535c0a46e155ff59b2c1bec6860c8f9788e08a728ffd377be779 is signed ✓ /efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi_b3_cab668b7718f847cfcfb42478424b4b7c2291377a46e00192ea1fadbfc0f0720 is signed ✓ /efi/e558c7a46f9349a1b9fb39b8412ad16c/limine_history/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi_b3_f434e265ebc0db505dbe32a33799f694481458a1d28b62ea04636e7640dbe474 is signed ``` I took this a step further by nesting an `if` statement into the `sb_sign` function of `limine-common-functions`; if the signing fails, it attempts resetting the enrollment for the file and tries signing it again. ``` /usr/lib/limine/limine-common-functions ``` ``` [...] ### Secure boot sign sb_sign() { check_uefi || return 0 local file_path=$1 if [[ "$IS_SB_INSTALLED" != "yes" ]]; then return 0 fi # Check if the file exists if [[ ! -f "$file_path" ]]; then echo "Error: File '$file_path' does not exist." return 1 fi # Sign the file using sbctl if ! sbctl sign "$file_path" &>/dev/null; then echo "Error: Failed to sign the file '$file_path'." echo "Attempting to reset enrollment for '$file_path'..." /usr/bin/limine-reset-enroll "$file_path" if ! sbctl sign "$file_path" &>/dev/null; then echo "Error: Failed to sign the file '$file_path'." return 1 else echo "File '$file_path' signed successfully." return 0 fi fi echo "File '$file_path' signed successfully." return 0 } [...] ``` It seems kind of hacky...probably not the best way to handle this, I'm not sure, but it does seem to resolve the issue. See here, reinstalling the kernel still throws the error but then the attempt to reset the enrollment and sign again succeeds: ``` ❯ pacman -S linux-zen warning: linux-zen-6.14.5.zen1-1 is up to date -- reinstalling resolving dependencies... looking for conflicting packages... Package (1) Old Version New Version Net Change extra/linux-zen 6.14.5.zen1-1 6.14.5.zen1-1 0.00 MiB Total Installed Size: 144.42 MiB Net Upgrade Size: 0.00 MiB :: Proceed with installation? [Y/n] (1/1) checking keys in keyring [------------------------------------------------] 100% (1/1) checking package integrity [------------------------------------------------] 100% (1/1) loading package files [------------------------------------------------] 100% (1/1) checking for file conflicts [------------------------------------------------] 100% (1/1) checking available disk space [------------------------------------------------] 100% :: Running pre-transaction hooks... (1/2) Performing snapper pre snapshots for the following configurations... ==> root: 25 (2/2) Wait for limine-snapper-sync to finish before updating, installing or removing. :: Processing package changes... (1/1) reinstalling linux-zen [------------------------------------------------] 100% :: Running post-transaction hooks... (1/9) Arming ConditionNeedsUpdate... (2/9) Updating module dependencies... (3/9) Updating initramfs... Building UKI for linux-zen (6.14.5-zen1-1-zen) File '/efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi' signed successfully. Updated successfully: /efi/limine.conf UKI stored in: /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi Config file BLAKE2B successfully enrolled! Error: Failed to sign the file '/efi/EFI/Limine/limine_x64.efi'. Attempting to reset enrollment for '/efi/EFI/Limine/limine_x64.efi'... File '/efi/EFI/Limine/limine_x64.efi' signed successfully. (4/9) Keep the last cache and the currently installed. ==> no candidate packages found for pruning (5/9) Foreign/AUR package notification jellyfin-tui 1.1.3-1 squiid 1.3.0-1 (6/9) Orphaned package notification... => No orphans found. (7/9) Checking for .pacnew and .pacsave files... (8/9) Signing EFI binaries... Generating EFI bundles.... File has already been signed /efi/EFI/limine/limine_x64.bak File has already been signed /efi/EFI/limine/limine_x64.efi File has already been signed /efi/EFI/BOOT/BOOTX64.EFI File has already been signed /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-hardened.efi File has already been signed /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-lts.efi File has already been signed /efi/EFI/Linux/e558c7a46f9349a1b9fb39b8412ad16c_linux-zen.efi File has already been signed /efi/EFI/limine/BOOTX64.EFI (9/9) Performing snapper post snapshots for the following configurations... ==> root: 26 ``` This same hack works on the `limine-snapper-watcher` errors in the journal as well. ``` May 04 21:29:55 limine-snapper-watcher[126063]: Read the Limine config: /efi/limine.conf May 04 21:29:55 limine-snapper-watcher[126063]: Saved successfully: /efi/limine.conf May 04 21:29:55 limine-snapper-watcher[126063]: Config file BLAKE2B successfully enrolled! May 04 21:29:55 limine-snapper-watcher[126063]: Error: Failed to sign the file '/efi/EFI/Limine/limine_x64.efi'. May 04 21:29:55 limine-snapper-watcher[126063]: Attempting to reset enrollment for '/efi/EFI/Limine/limine_x64.efi'... May 04 21:29:55 limine-snapper-watcher[126063]: File '/efi/EFI/Limine/limine_x64.efi' signed successfully. May 04 21:29:55 limine-snapper-watcher[1283]: Event DELETE,ISDIR for 56 in the directory /.snapshots/ May 04 21:29:55 limine-snapper-watcher[126192]: Read the Limine config: /efi/limine.conf May 04 21:29:55 limine-snapper-watcher[126192]: Saved successfully: /efi/limine.conf May 04 21:29:55 limine-snapper-watcher[126192]: Config file BLAKE2B successfully enrolled! May 04 21:29:55 limine-snapper-watcher[126192]: Error: Failed to sign the file '/efi/EFI/Limine/limine_x64.efi'. May 04 21:29:55 limine-snapper-watcher[126192]: Attempting to reset enrollment for '/efi/EFI/Limine/limine_x64.efi'... May 04 21:29:55 limine-snapper-watcher[126192]: File '/efi/EFI/Limine/limine_x64.efi' signed successfully. May 04 21:29:55 limine-snapper-watcher[1283]: Event DELETE,ISDIR for 57 in the directory /.snapshots/ May 04 21:29:56 limine-snapper-watcher[126319]: Read the Limine config: /efi/limine.conf May 04 21:29:56 limine-snapper-watcher[126319]: Saved successfully: /efi/limine.conf May 04 21:29:56 limine-snapper-watcher[126319]: Config file BLAKE2B successfully enrolled! May 04 21:29:56 limine-snapper-watcher[126319]: Error: Failed to sign the file '/efi/EFI/Limine/limine_x64.efi'. May 04 21:29:56 limine-snapper-watcher[126319]: Attempting to reset enrollment for '/efi/EFI/Limine/limine_x64.efi'... May 04 21:29:56 limine-snapper-watcher[126319]: File '/efi/EFI/Limine/limine_x64.efi' signed successfully. May 04 21:29:56 limine-snapper-watcher[1283]: Event DELETE,ISDIR for 58 in the directory /.snapshots/ May 04 21:29:56 limine-snapper-watcher[126446]: Read the Limine config: /efi/limine.conf May 04 21:29:56 limine-snapper-watcher[126446]: Saved successfully: /efi/limine.conf May 04 21:29:56 limine-snapper-watcher[126446]: Config file BLAKE2B successfully enrolled! May 04 21:29:56 limine-snapper-watcher[126446]: Error: Failed to sign the file '/efi/EFI/Limine/limine_x64.efi'. May 04 21:29:56 limine-snapper-watcher[126446]: Attempting to reset enrollment for '/efi/EFI/Limine/limine_x64.efi'... May 04 21:29:56 limine-snapper-watcher[126446]: File '/efi/EFI/Limine/limine_x64.efi' signed successfully. May 04 21:29:56 limine-snapper-watcher[1283]: Event DELETE,ISDIR for 59 in the directory /.snapshots/ May 04 21:29:56 limine-snapper-watcher[126574]: Read the Limine config: /efi/limine.conf May 04 21:29:56 limine-snapper-watcher[126574]: Saved successfully: /efi/limine.conf May 04 21:29:56 limine-snapper-watcher[126574]: Config file BLAKE2B successfully enrolled! May 04 21:29:56 limine-snapper-watcher[126574]: Error: Failed to sign the file '/efi/EFI/Limine/limine_x64.efi'. May 04 21:29:56 limine-snapper-watcher[126574]: Attempting to reset enrollment for '/efi/EFI/Limine/limine_x64.efi'... May 04 21:29:56 limine-snapper-watcher[126574]: File '/efi/EFI/Limine/limine_x64.efi' signed successfully. May 04 21:29:56 limine-snapper-watcher[1283]: Event DELETE,ISDIR for 60 in the directory /.snapshots/ May 04 21:29:57 limine-snapper-watcher[126700]: Read the Limine config: /efi/limine.conf May 04 21:29:57 limine-snapper-watcher[126700]: Saved successfully: /efi/limine.conf May 04 21:29:57 limine-snapper-watcher[126700]: Config file BLAKE2B successfully enrolled! May 04 21:29:57 limine-snapper-watcher[126700]: Error: Failed to sign the file '/efi/EFI/Limine/limine_x64.efi'. May 04 21:29:57 limine-snapper-watcher[126700]: Attempting to reset enrollment for '/efi/EFI/Limine/limine_x64.efi'... May 04 21:29:57 limine-snapper-watcher[126700]: File '/efi/EFI/Limine/limine_x64.efi' signed successfully. May 04 21:30:56 systemd[1]: snapperd.service: Deactivated successfully. ``` Probably keeping so many echo lines in the function is not needed (it's a lot of journal spam), I just haven't gone any further with it because I thought maybe I should check in and see what you think. Please let me know if there is anything I can do to help with this issue, or if it just something I have misconfigured on my end. Thanks for taking a look!