Improving the Secure Boot user experience

Mon, 18 May 2020 00:00:00 +0200

Secure boot tooling is terrible, can we do better?

Currently the most widely used tooling for secure boot is the Ubuntu sbsigntools and efitools. If you are currently using secure boot both of these packages are probably installed on your system. Both of them support the basics of generating signature lists and signing the EFI variables with certificates, but they still have differences which is a source of confusion.

efitools has 3 different ways of generating signature lists: cert-to-efi-hash-list, cert-to-sig-list and hash-to-efi-sig-list. “Luckily” there are man pages you can read which assumes you have some familiarity with UEFI itself.

Secure Boot on Morten Linderud

Improving the Secure Boot user experience