fix: stop the NVIDIA install under Secure Boot and keep the 2FA field visible to Bitwarden

scripts/gpu_tpu/nvidia_installer.sh

@@ -32,6 +32,7 @@ BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
 COMPONENTS_STATUS_FILE="$BASE_DIR/components_status.json"
 LOG_FILE="/tmp/nvidia_install.log"
+SECURE_BOOT_EFIVAR="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c"
 screen_capture="/tmp/proxmenux_nvidia_screen_capture_$$.txt"
 
 NVIDIA_BASE_URL="https://download.nvidia.com/XFree86/Linux-x86_64"
@@ -136,6 +137,29 @@ check_gpu_not_in_vm_passthrough() {
   exit 0
 }
 
+# The variable holds 4 attribute bytes followed by the state.
+secure_boot_enabled() {
+  local state
+  state=$(od -An -t u1 -j4 -N1 "$SECURE_BOOT_EFIVAR" 2>/dev/null)
+  [[ "${state//[[:space:]]/}" == "1" ]]
+}
+
+# The installer builds an unsigned module, which the kernel refuses under
+# Secure Boot. Asked before anything is removed, so the driver stays in place.
+check_secure_boot_for_install() {
+  secure_boot_enabled || return 0
+
+  local msg
+  msg="\n$(translate "Secure Boot is enabled on this host.")\n\n"
+  msg+="$(translate "The kernel only loads signed modules and this installer builds the NVIDIA module unsigned, so the installation would fail.")\n\n"
+  msg+="$(translate "Disable Secure Boot in the UEFI firmware and run the installer again. Nothing has been changed.")"
+
+  dialog --backtitle "ProxMenux" \
+    --title "$(translate "Secure Boot Enabled")" \
+    --msgbox "$msg" 14 78
+  exit 0
+}
+
 check_stale_vfio_config_for_nvidia() {
   pmx_journal_context "check_stale_vfio_config_for_nvidia" "1.3" "nvidia_installer.sh"
   local vfio_conf="/etc/modprobe.d/vfio.conf"
@@ -1634,6 +1658,16 @@ run_nvidia_installer() {
   return 0
 }
 
+# Keeps the failure on screen: the menu redraws as soon as the script exits.
+show_nvidia_install_failure() {
+  local reason
+  reason=$(grep -a -m1 '^ERROR:' /var/log/nvidia-installer.log 2>/dev/null | sed 's/^ERROR: *//' | cut -c1-300)
+  [[ -n "$reason" ]] || reason=$(grep -a -m1 '^ERROR:' "$LOG_FILE" 2>/dev/null | sed 's/^ERROR: *//' | cut -c1-300)
+
+  hybrid_msgbox "$(translate 'NVIDIA driver not installed')" \
+    "\n$(translate 'The NVIDIA installer stopped with this error:')\n\n${reason}\n\n$(translate 'Log file'): ${LOG_FILE}\n$(translate 'Log file'): /var/log/nvidia-installer.log" 18 78
+}
+
 remove_nvidia_driver() {
   complete_nvidia_uninstall
 }
@@ -2156,6 +2190,8 @@ main() {
 
   case "$ACTION" in
     install)
+      check_secure_boot_for_install
+
       if ! show_install_overview; then
         exit 0
       fi
@@ -2257,6 +2293,7 @@ main() {
 
       if ! run_nvidia_installer "$installer"; then
         rm -f "$screen_capture"
+        show_nvidia_install_failure
         exit 1
       fi
       
@@ -2448,6 +2485,12 @@ auto_reinstall_from_state() {
     return 0
   fi
 
+  if secure_boot_enabled; then
+    echo "Secure Boot is enabled: the kernel would refuse the unsigned module — skipping host driver reinstall" \
+      | tee -a "$LOG_FILE"
+    return 2
+  fi
+
   DRIVER_VERSION="$recorded_version"
 
   # Same install path as the interactive main() flow, minus all