shim: ensure binaries do not get installed to ESP with .signed suffix

Binaries in the ESP need to be .efi, not .efi.signed,
so truncate the filename if the source has it (like MOK
in Debian).

diff --git a/mkosi/bootloader.py b/mkosi/bootloader.py
index 6f112b854f72a8863dc5e7348f0154851d3dda96..20bfb4921c3660487add39902eb5853a63437337 100644 (file)
--- a/mkosi/bootloader.py
+++ b/mkosi/bootloader.py
@@ -585,6 +585,10 @@ def find_and_install_shim_binary(
 
                 rel = p.relative_to(context.root)
                 if (context.root / output).is_dir():
+                    # The ESP wants .efi files, not .efi.signed or .efi.signed.latest
+                    if rel.suffix and rel.suffix != ".efi":
+                        left_stem, _ = rel.name.split(".", maxsplit=1)
+                        rel = rel.with_name(f"{left_stem}.efi")
                     output /= rel.name
 
                 log_step(f"Installing signed {name} EFI binary from /{rel} to /{output}")