sign-cachy-kernels

Signs all installed non-rescue kernels with a local Secure Boot key.

I needed this because I keep Secure Boot enabled to play Valorant on Windows, while still wanting to boot CachyOS kernels on the same machine. CachyOS kernels are not signed, so this script signs them with my local key so they can boot after I enroll that cert.

Requirements:

• openssl
• sbsigntools
• root

Usage:

sudo ./sign-latest-kernel.sh

Notes:

• Generates or reuses a keypair in /root/.kernel-signing-keys
• Copies the public DER cert to /boot/efi/EFI/fedora/kernel.der
• Skips kernels already signed with the local cert
• Does not keep .unsigned backups unless --keep-backup is used