[WIP] Enable dm-verity roothash signature

Author: danzatt

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.12.40.ebuild

@@ -64,6 +64,7 @@ src_prepare() {
 	validate_sig_key
 
 	config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"'
+	config_update "CONFIG_SYSTEM_TRUSTED_KEYS=\"/usr/share/sb_keys/shim.pem\""
 
 	# include all intel and amd microcode files, avoiding the signatures
 	local fw_dir="${ESYSROOT}/lib/firmware"

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12

@@ -166,6 +166,7 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
 CONFIG_DM_UEVENT=y
 CONFIG_DM_VERITY=m
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_DM_ZERO=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_DRM=m