[{"title":"Setting up NVIDIA Drivers on systemd-boot Fedora","url":"/en/posts/systemd-nvidia/","date":"2026-07-26","tags":["driver","linux"],"summary":"0. Before we begin# I carried out installation on my Dell Precision 5570 laptop, steps to enroll db keys may vary depending on your PC.\nThere are two separate trust operations:\nEFI signing: firmware …","content":" 0. Before we begin# I carried out installation on my Dell Precision 5570 laptop, steps to enroll db keys may vary depending on your PC.\nThere are two separate trust operations:\nEFI signing: firmware db trusts systemd-boot and your UKI. Kernel-module signing: the NVIDIA modules are signed by a key the kernel trusts. No MOK is needed when booting directly through systemd-boot, provided the module certificate is in firmware db and Fedora imports that key into a keyring accepted for module verification. The tutorials online are mainly about grub+shim and will often require you to enroll a MOK key.\n1. Install Required Packages# Enable RPM Fusion according to the Fedora version, then install:\nbash COPY 1sudo dnf install akmods kernel-devel-matched openssl keyutils efitools sbctl Make sure the matching kernel development files exist:\nbash COPY 1KVER=$(uname -r) 2test -x /usr/src/kernels/\u0026amp;#34;$KVER\u0026amp;#34;/scripts/sign-file 2. Create A Dedicated akmods Key# Generate the Fedora akmods key if the package has not already done so:\nbash COPY 1sudo kmodgenca -a Check the paths:\nbash COPY 1sudo readlink -e /etc/pki/akmods/private/private_key.priv 2sudo readlink -e /etc/pki/akmods/certs/public_key.der Both commands must return real files.\nConfirm the certificate:\nbash COPY 1sudo openssl x509 \\ 2 -inform DER \\ 3 -in /etc/pki/akmods/certs/public_key.der \\ 4 -noout -subject -issuer -fingerprint -sha256 This should not be null\n3. Fix Akmods Key Permissions# The RPM build runs as the unprivileged akmods user. Root could resolve and read the symlink, but akmods could not access its target. Consequently this test failed inside the build:\nbash COPY 1[ -e /etc/pki/akmods/private/private_key.priv ] The shell short-circuited the signing condition, so it never checked public_key.der and never called /usr/lib/rpm/brp-kmodsign.\nApply permissions to the resolved targets as well as ensuring directory traversal:\nbash COPY 1PRIVATE=$(sudo readlink -e /etc/pki/akmods/private/private_key.priv) …"},{"title":"Delete CF Pages Deployments","url":"/en/posts/cf-too-many-deploy/","date":"2026-07-25","tags":["cloudflare","pages","tools"],"summary":"You may encounter the error Your project has too many deployments to be deleted, follow this guide to delete them: https://cfl.re/3CXesln when trying to delete a pages project which has more than …","content":"You may encounter the error Your project has too many deployments to be deleted, follow this guide to delete them: https://cfl.re/3CXesln when trying to delete a pages project which has more than approx. 100 deployments(each construction is considered as one build, like you updated an entry in your blog)\nSo I tell the big fat fish(Deepseek) to write a python script for me to automatically delete the deployments so that I can delete the project afterwards. The repo cloudflare-buik-delete is broken as the records per page of the pages api query is limited at 25, while the tool send queries with 100 records per page, causing HTTP 400 error\npython COPY 1#!/usr/bin/env python3 2\u0026amp;#34;\u0026amp;#34;\u0026amp;#34;Bulk delete all Cloudflare Pages deployments in a project.\u0026amp;#34;\u0026amp;#34;\u0026amp;#34; 3 4import os 5import sys 6import requests 7 8# Config — set these via environment variables or edit inline 9ACCOUNT_ID = os.environ.get(\u0026amp;#34;CLOUDFLARE_ACCOUNT_ID\u0026amp;#34;, \u0026amp;#34;your_account_id\u0026amp;#34;) 10TOKEN = os.environ.get(\u0026amp;#34;CLOUDFLARE_API_TOKEN\u0026amp;#34;, \u0026amp;#34;cfut_kfcCRAZYthursday\u0026amp;#34;) 11PROJECT = os.environ.get(\u0026amp;#34;CLOUDFLARE_PROJECT\u0026amp;#34;, \u0026amp;#34;hugo\u0026amp;#34;) 12 13BASE = f\u0026amp;#34;https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/pages/projects/{PROJECT}/deployments\u0026amp;#34; 14HEADERS = {\u0026amp;#34;Authorization\u0026amp;#34;: f\u0026amp;#34;Bearer {TOKEN}\u0026amp;#34;} 15 16 17def fetch_all_deployment_ids(): 18 \u0026amp;#34;\u0026amp;#34;\u0026amp;#34;Fetch all deployment IDs across all pages.\u0026amp;#34;\u0026amp;#34;\u0026amp;#34; 19 ids = [] 20 page = 1 21 while True: 22 resp = requests.get(f\u0026amp;#34;{BASE}?page={page}\u0026amp;#34;, headers=HEADERS).json() 23 if not resp[\u0026amp;#34;success\u0026amp;#34;]: 24 print(f\u0026amp;#34;Error fetching page {page}: {resp[\u0026amp;#39;errors\u0026amp;#39;]}\u0026amp;#34;, file=sys.stderr) 25 sys.exit(1) 26 27 ids.extend(d[\u0026amp;#34;id\u0026amp;#34;] for d in resp[\u0026amp;#34;result\u0026amp;#34;]) 28 total_pages = resp[\u0026amp;#34;result_info\u0026amp;#34;][\u0026amp;#34;total_pages\u0026amp;#34;] 29 print(f\u0026amp;#34; Page {page}/{total_pages} — collected {len(ids)} total\u0026amp;#34;) 30 31 if page \u0026amp;gt;= total_pages: 32 break 33 page += 1 34 35 return ids 36 37 38def …"},{"title":"Signing systemd-boot files and enroll PK for secure boot","url":"/en/posts/systemd-secureboot/","date":"2026-07-25","tags":["linux"],"summary":"0. Before we begin# Lately I tried to install Fedora to replace Ubuntu to get rid of the snap s**t. And I got an idea from nowhere deciding to give systemd-boot a try, so that\u0026rsquo;s how the …","content":" 0. Before we begin# Lately I tried to install Fedora to replace Ubuntu to get rid of the snap s**t. And I got an idea from nowhere deciding to give systemd-boot a try, so that\u0026amp;rsquo;s how the nightmare begins.\nThere are two separate trust operations:\nEFI signing: firmware db trusts systemd-boot and your UKI. Kernel-module signing: the NVIDIA modules are signed by a key the kernel trusts. No MOK is needed when booting directly through systemd-boot, provided the module certificate is in firmware db and Fedora imports that key into a keyring accepted for module verification. The tutorials online are mainly about grub+shim and will often require you to enroll a MOK key.\nIf you are not interested in my install process and how I configured systemd-boot for secure boot, please skip chapter 0.\nInstalling Fedora# The systemd-boot approach is only configurable using Everything netinst image (it is said that the offline images are also possible to do that, but with more complex steps). When you boots up from your usb-key, navigate to\nCreate keys:\nbash COPY 1sudo sbctl create-keys Enroll the sbctl keys while retaining Microsoft certificates:\nbash COPY 1sudo sbctl enroll-keys -m The -m matters when Microsoft-signed option ROMs, Windows, or other Microsoft-signed EFI components are needed.\nSign enrolled EFI files:\nbash COPY 1sudo sbctl sign-all 2sudo sbctl verify "}]