search

gdamjan / secure-boot

UEFI SecureBoot for ArchLinux
59 stars 3 forks source link

Migrate to sbkeysync #17

Open gdamjan opened 3 years ago

gdamjan commented 3 years ago

https://wiki.archlinux.org/index.php/Unified_Extensible_Firmware_Interface/Secure_Boot#Using_sbkeysync

sbkeysync, part of sbsigntools, is a tool to enroll the keys automatically. Alas, it assumes its own directory structure for the keys and certificates a bit different than what I did with this tool. While this tools creates all the files in /etc/secure-boot, it expects a hierarchy /etc/secureboot/keys/{db,dbx,KEK,PK}

maximbaz commented 3 years ago

Cool idea! As a heads-up, only .auth files need to go to /etc/secureboot/keys/ folder, the tool will complain if you put anything else there... 🤦‍♂️

I just went through getting rid of efitools dependency altogether in favor of tools in sbsigntools, might be useful for you as a reference: https://github.com/maximbaz/arch-secure-boot/commit/485b6cf2d1ebd14d12377f63976f6c7c0d8d91bf

gdamjan commented 3 years ago

did you test sbkeysync? it didn't work for me in a VM. I still haven't tried it on a real-metal machine.

maximbaz commented 3 years ago

Yes, I tested everything end-to-end on my laptop, it works well 👍

gdamjan commented 3 years ago

or https://github.com/systemd/systemd/pull/18716