# kernel-yny-keys: public key for kernel-yny kernel signatures
# Maintains the public half of the kernel-yny signing key pair
# (generated from the kgpg identity Ye Ningyuan <ynyusearchlinux@gmail.com>).
# Private key lives only in the kernel-yny source tree (certs/signing_key.pem)
# and is used by the build pipeline to sign the kernel image + modules.

Name:           kernel-yny-keys
Version:        1.0
Release:        1%{?dist}
Summary:        Public key for kernel-yny kernel signatures
License:        GPL-2.0-only
URL:            https://copr.fedorainfracloud.org/coprs/chinese-yening/kernel-yny/
BuildArch:      noarch
Source0:        kernel-yny-signing.crt
Source1:        kernel-yny-signing.der

%description
Public key (x509 certificate) used to verify signatures on the kernel-yny
kernel image and its modules.

The matching private key signs:
  - vmlinuz (PE/EFI signature, sbsign)
  - all in-tree modules (CONFIG_MODULE_SIG_ALL)
in the kernel-yny build pipeline.

Usage:
  - Verify kernel image:  sbverify --cert %{_sysconfdir}/pki/kernel-yny/kernel-yny-signing.crt /boot/vmlinuz-*
  - Secure Boot / MOK:    sudo mokutil --import %{_sysconfdir}/pki/kernel-yny/kernel-yny-signing.der
                          (reboot and enroll in the MOK manager screen)

%install
mkdir -p %{buildroot}%{_sysconfdir}/pki/kernel-yny
install -m 0644 %{SOURCE0} %{buildroot}%{_sysconfdir}/pki/kernel-yny/kernel-yny-signing.crt
install -m 0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/pki/kernel-yny/kernel-yny-signing.der

%files
%{_sysconfdir}/pki/kernel-yny/kernel-yny-signing.crt
%{_sysconfdir}/pki/kernel-yny/kernel-yny-signing.der

%changelog
* Sun Aug 16 2026 Ye Ningyuan <ynyusearchlinux@gmail.com> - 1.0-1
- Initial release: public key for kernel-yny kernel signing