Proper way for pacman hook to remove old kernel images

[phantom-voltage]

Hi all,

I'm encountering a problem with each new kernel image, the pacman hook to remove old images is not being called.

/usr/lib/kernel/install.d/998-sbctl.install

remove)
        [ "$KERNEL_INSTALL_VERBOSE" -gt 0 ] &&
                printf 'Removing kernel %s from signing database\n' "$IMAGE_FILE"
        sbctl remove-file "$IMAGE_FILE" 1>/dev/null
        ;;
esac

This results in old kernel images remaining in /usr/share/secureboot/files.db and the install of a new image to fail trying to sign a file that does not exist:

$ sudo pacman -Syu
[...]
==> Generating module dependencies
==> Creating zstd-compressed initcpio image: '/boot/initramfs-linux-fallback.img'
==> Image generation successful
(5/5) Signing EFI binaries...
Generating EFI bundles....
File has already been signed /efi/EFI/BOOT/BOOTX64.EFI
failed signing /efi/EFI/Linux/linux-6.2.8-arch1-1-[machine-id]-rolling.efi: /efi/EFI/Linux/linux-6.2.8-arch1-1-[machine-id]-rolling.efi does not exist
error: command failed to execute correctly

This is resolved by manually removing the non-existent file from files.db and signing them manually.

I'm not sure if this is a configuration issue, changes in Arch, or the hook itself. Any insight would be greatly appreciated.

I'm using:
Arch Linux
systemd-boot with dracut