Repository navigation
How to enroll just the signed auth variables, without also supplying private key? #434
Description
- sbctl can export signed auth variables:
sbctl enroll-keys --microsoft --export auth - sbctl can import cert/key pairs
- apparently sbctl cannot import signed auth variables
- but putting the private key on the target machine may not be possible for security reasons
Do we have to use efitools for enrolling here? (like for example, efi-updatevar -f db.auth db)
It would be nice if sbctl alone could enroll signed auth variables too.
Activity
Foxboron commentedon Apr 29, 2025
You can also use
sd-bootfor this. But generally havingsbctlsupport enrolling.authmight be useful yes.sbctlexpects all key material to be present currently. I have some ideas that having an "offline" or "client-mode" tosbctlwould be useful, or allow key material to be missing for hardware keys. But currently haven't made any progress towards this.h908714124 commentedon Apr 29, 2025
Good idea. Unfortunately
sd-bootmay not work in our situation (efi + pxe + ipxe).sd-bootseems to require an esp (forloader.conf), but this is a network boot, so there is none.h908714124 commentedon May 5, 2025
Turns out we can also avoid
efitoolsby splitting the enrolling of anauthfile into two steps:authfile to "vardata" format (doesn't have to happen on the target machine)For the first step, I have created mkefivardata. It is recycled c-code from
efitools.