build: Key the Secure Boot signing layers on the certificate

Dockerfile

@@ -251,13 +251,17 @@ EORUN
 
 # This image signs systemd-boot using our key, and writes the resulting binary into /out
 FROM tools as sdboot-signed
+# The certificate is also a build secret, but secrets aren't part of the layer
+# cache key. Copying it in makes the signing below rebuild when it changes.
+COPY --from=secureboot db.crt /usr/lib/bootc-test/secureboot-db.crt
 # The secureboot key and cert are passed via Justfile
 # We write the signed binary into /out
 # Note: /out already contains systemd-boot-unsigned RPM from initialize-sealing-tools
 RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
     --mount=type=secret,id=secureboot_key \
     --mount=type=secret,id=secureboot_cert <<EORUN
 set -xeuo pipefail
+sha256sum /usr/lib/bootc-test/secureboot-db.crt
 
 # Extract the unsigned systemd-boot binary from the downloaded RPM
 # Work around https://github.com/bootc-dev/bootc/issues/1896
@@ -359,13 +363,17 @@ ARG erofs_version=auto
 RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
     --mount=type=bind,from=packages,src=/,target=/run/packages \
     rpm -Uvh --oldpackage --replacepkgs --nosignature /run/packages/bootc-*.rpm
+# The certificate is also a build secret, but secrets aren't part of the layer
+# cache key. Copying it in makes the signing below rebuild when it changes.
+COPY --from=secureboot db.crt /usr/lib/bootc-test/secureboot-db.crt
 RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
     --mount=type=secret,id=secureboot_key \
     --mount=type=secret,id=secureboot_cert \
     --mount=type=bind,from=target-base,src=/kernel,target=/run/kernel \
     --mount=type=bind,from=packaging,src=/,target=/run/packaging \
     --mount=type=bind,from=base-penultimate,src=/,target=/run/target <<EORUN
 set -xeuo pipefail
+sha256sum /usr/lib/bootc-test/secureboot-db.crt
 
 allow_missing_verity=()
 

Justfile

@@ -81,7 +81,8 @@ base_buildargs := generic_buildargs + " " + _extra_src_args \
                   + " --build-arg=baseconfigs=" + baseconfigs
 buildargs := base_buildargs \
              + " --cap-add=all --security-opt=label=type:container_runtime_t --device /dev/fuse" \
-             + " --secret=id=secureboot_key,src=target/test-secureboot/db.key --secret=id=secureboot_cert,src=target/test-secureboot/db.crt"
+             + " --secret=id=secureboot_key,src=target/test-secureboot/db.key --secret=id=secureboot_cert,src=target/test-secureboot/db.crt" \
+             + " --build-context=secureboot=target/test-secureboot"
 
 # ============================================================================
 # Core workflows - the main targets most developers will use
@@ -517,6 +518,7 @@ _build-upgrade-image:
         --build-arg "erofs_version={{erofs_version}}" \
         --secret=id=secureboot_key,src=target/test-secureboot/db.key \
         --secret=id=secureboot_cert,src=target/test-secureboot/db.crt \
+        --build-context=secureboot=target/test-secureboot \
         "${extra_args[@]}" \
         -t {{upgrade_img}} \
         -f tmt/tests/Dockerfile.upgrade \

tmt/tests/Dockerfile.upgrade

@@ -44,13 +44,17 @@ RUN --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
 # container ukify command it provides is needed for seal-uki.
 FROM tools AS sealed-upgrade-uki
 ARG boot_type seal_state filesystem erofs_version
+# The certificate is also a build secret, but secrets aren't part of the layer
+# cache key. Copying it in makes the signing below rebuild when it changes.
+COPY --from=secureboot db.crt /usr/lib/bootc-test/secureboot-db.crt
 RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
     --mount=type=secret,id=secureboot_key \
     --mount=type=secret,id=secureboot_cert \
     --mount=type=bind,from=packaging,src=/,target=/run/packaging \
     --mount=type=bind,from=kernel,src=/,target=/run/kernel \
     --mount=type=bind,from=upgrade-base,src=/,target=/run/target <<EORUN
 set -xeuo pipefail
+sha256sum /usr/lib/bootc-test/secureboot-db.crt
 
 allow_missing_verity=()