From b948557cd759236451a74b1553a2634536c699b8 Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Sat, 13 Jun 2026 07:02:38 +0000
Subject: [PATCH] Add systemd-boot-efi to the runner

---
 .gitea/workflows/gitea-main-ci.yaml | 7 ++++++-
 CLAUDE.md                           | 6 ++++--
 README.md                           | 3 ++-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/gitea-main-ci.yaml b/.gitea/workflows/gitea-main-ci.yaml
index 3586099..827d8ea 100644
--- a/.gitea/workflows/gitea-main-ci.yaml
+++ b/.gitea/workflows/gitea-main-ci.yaml
@@ -82,9 +82,14 @@ jobs:
         # make /boot readable (Ubuntu ships vmlinuz mode 0600).
         run: |
           sudo apt-get update
+          # systemd-boot-efi ships the UKI EFI stub
+          # (/usr/lib/systemd/boot/efi/linuxx64.efi.stub) that ukify wraps the
+          # kernel+initrd+cmdline around. It's only a *recommends* of
+          # systemd-ukify, so --no-install-recommends would otherwise skip it.
           sudo apt-get install -y --no-install-recommends \
             qemu-system-x86 qemu-utils libguestfs-tools linux-image-generic \
-            erofs-utils cryptsetup-bin jq systemd-ukify buildah shellcheck
+            erofs-utils cryptsetup-bin jq systemd-ukify systemd-boot-efi \
+            buildah shellcheck
           sudo chmod 0644 /boot/vmlinuz-* 2>/dev/null || true
 
       -
diff --git a/CLAUDE.md b/CLAUDE.md
index 6dece16..b22cd05 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -49,8 +49,10 @@ bash -n files/dracut/95dot1x-macsec/*.sh scripts/*.sh   # shell syntax gate
 shellcheck --exclude=SC1091,SC2154 files/dracut/95dot1x-macsec/*.sh scripts/*.sh
 ```
 
-Build-host deps: qemu-kvm, libguestfs-tools, erofs-utils, cryptsetup, jq,
-systemd-ukify, sbsigntools, buildah (or docker).
+Build-host deps: qemu-kvm, libguestfs-tools (+ a kernel for its supermin
+appliance), erofs-utils, cryptsetup, jq, systemd-ukify **and systemd-boot-efi**
+(the latter ships the `linuxx64.efi.stub` ukify needs), sbsigntools,
+buildah (or docker).
 
 ## Architecture invariants — do not violate these
 
diff --git a/README.md b/README.md
index d86b352..24d2c67 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,8 @@ docs/diskless-fleet-design-v2.pdf         Architecture design (authoritative)
 - Packer >= 1.10, qemu plugin (`packer init .`)
 - qemu-kvm with KVM available
 - libguestfs-tools, **erofs-utils**, **cryptsetup**, jq (artifact extraction)
-- **systemd-ukify** (+ **sbsigntools** when signing) — UKI assembly
+- **systemd-ukify** + **systemd-boot-efi** (the EFI stub `ukify` wraps;
+  it's only a *recommends* of ukify) (+ **sbsigntools** when signing) — UKI assembly
 - **buildah** (or docker) — OCI release-artifact image build
 
 The default `iso_url`/`iso_checksum` point at a version-pinned **Rocky 9.x