3 ms·
Fascinating! How do you sign your kernel every time you recompile it? Do you need to store a new key into the UEFI every time?
by teo_zero 4y ago
Fascinating! How do you sign your kernel every time you recompile it? Do you need to store a new key into the UEFI every time?
- vladvasiliu 4y agoI use sbupdate [0] to build the unified kernel image and to sign it with my keys. It's run by a hook in the arch's package manager whenever the kernel, the initrd or the firmware images change. I saw the other day that systemd recently got an utility to do this, but I've never looked into that. sbupdate has been working fine for me for several years now. It doesn't store a new key in the uefi, it signs the new image with the key that uefi already knows about. See [1] for the whole setup and [2] for the signing part specifically. [0] https://github.com/andreyv/sbupdate https://github.com/andreyv/sbupdate [1] https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Using_your_own_keys https://wiki.archlinux.org/title/Unified_Extensible_Firmware... [2] https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Fully_automated_unified_kernel_generation_and_signing_with_sbupdate https://wiki.archlinux.org/title/Unified_Extensible_Firmware...