jlobue10/rEFInd_GUI v3.5.6 on GitHub

rEFInd_GUI 3.5.6

Secure Boot signing on every sbctl-managed distro. Until now the rEFInd install scripts signed the freshly written EFI binaries only on CachyOS, by calling its sbctl-batch-sign. Every Linux package (pacman, deb, rpm, both architectures) now ships the same script as /etc/rEFInd/sbctl-batch-sign, and both installers run it whenever Secure Boot is enabled and sbctl status reports keys installed, or the OS is CachyOS. CachyOS' own copy is still preferred when it is on PATH; otherwise the packaged one is used. That covers Fedora/Nobara with the sbctl COPR, Arch and Arch Linux ARM, and Debian/Ubuntu.
- The script signs every file sbctl verify reports as unsigned on the ESP with sbctl sign -s, so sbctl's package hook keeps them signed across kernel and boot-loader updates. It skips Microsoft's own files (already signed; enroll your keys with sbctl enroll-keys -m) and GRUB, and refuses to run on a Limine install. It can be run by hand at any time: sudo /etc/rEFInd/sbctl-batch-sign.
- A missing signer or a failed sign aborts the install before the boot entry is published, as before on CachyOS. Secure Boot enforced by shim/MOK instead of sbctl is still left alone, now with a warning instead of silence.

The packaged script is root-owned; the installers never execute a copy from the user-writable data directory.
The Windows installers are unchanged apart from the version.

Re-run the installer for your platform, or just update the deb, rpm or Arch package:

curl -L https://github.com/jlobue10/rEFInd_GUI/raw/main/install-rEFInd-GUI.sh | bash

Full Changelog: v3.5.5...v3.5.6