From e5ec5c94d82e20e3d798e97b6b844de91d63ecb9 Mon Sep 17 00:00:00 2001 From: Aliaksandr Date: Tue, 2 Jun 2026 02:00:53 +0300 Subject: [PATCH] nixos/limine: fix fwupd-efi signing script under strict shell checks The signing service builds `fwupd_efi` as a bash array but referenced it as a scalar, tripping SC2128 (array expanded without index) and SC2046 (unquoted command substitution). With enableStrictShellChecks these are promoted to errors, breaking the unit-script build when secureBoot, fwupd and strict shell checks are all enabled. Loop over the array and sign every matched fwupd EFI binary, quoting the basename and the -o argument. Indexing a single element would silently skip any additional files the glob matches. Assisted-by: claude-code with claude-opus-4-8[1m]-high --- nixos/modules/system/boot/loader/limine/limine.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nixos/modules/system/boot/loader/limine/limine.nix b/nixos/modules/system/boot/loader/limine/limine.nix index fd0ee9b2b36d..c9725a6fee00 100644 --- a/nixos/modules/system/boot/loader/limine/limine.nix +++ b/nixos/modules/system/boot/loader/limine/limine.nix @@ -503,7 +503,9 @@ in script = '' fwupd_efi=(${config.services.fwupd.package.fwupd-efi}/libexec/fwupd/efi/fwupd*.efi) - ${lib.getExe cfg.secureBoot.sbctl} sign -o /run/fwupd-efi/$(basename "$fwupd_efi").signed "$fwupd_efi" + for efi in "''${fwupd_efi[@]}"; do + ${lib.getExe cfg.secureBoot.sbctl} sign -o "/run/fwupd-efi/$(basename "$efi").signed" "$efi" + done ''; };