Supports for sealed-uki(bootc composefs)

[chlorodose]

When using composefs as bootc backend, bootc wants to generate an sealed uki. To do so, the only way is codes like:

# RUN /scripts/post_build.sh # Must run before sealing as it may modify image)

FROM ${tool_image} AS sealer
RUN --mount=type=bind,from=pre-sealing,target=/run/sysroot \
     bootc container ukify --rootfs /run/rootfs -- \
    --output "/run/artifact/uki.efi" # Note: This step calculate an hash for whole rootfs, so you shouldn't touch any file in the image after it(except for /{run,sysroot,boot} as they are not counted in)

FROM pre-sealing
COPY --from=sealer /run/artifact/uki.efi /boot/EFI/Linux/

# Label and commiting the image

Currently there are no way to run things after post build script so i'm pretty sure an extra function is required.

bootc docs here