Visitar URL original
systemd-sbsign: add verb to verify signed EFI binaries · Issue #35594 · systemd/systemd · GitHub
Skip to content

systemd-sbsign: add verb to verify signed EFI binaries #35594

New issue
New issue
Open
Open
systemd-sbsign: add verb to verify signed EFI binaries#35594
Labels
RFE 🎁Request for Enhancement, i.e. a feature requestsd-boot/sd-stub/bootctl

Description

@jammie-jelly
jammie-jelly
opened on Dec 13, 2024

Component

systemd

Is your feature request related to a problem? Please describe

With systemd-sbsign signing images, would be good to also include verification for the signed images.

Describe the solution you'd like

sbsigntools currently provides verification with sbverify, example:

sbverify --list /boot/EFI/Linux/${machineid}-6.11.5-arch1-1.efi
signature 1
image signature issuers:
 - /CN=Foo
image signature certificates:
 - subject: /CN=Foo
   issuer:  /CN=Foo

Describe alternatives you've considered

No response

The systemd version you checked that didn't have the feature you are asking for

257-1-arch

Activity

  1. jammie-jelly
    added
    RFE 🎁Request for Enhancement, i.e. a feature request
    on Dec 13, 2024
  2. github-actions
    added
    pid1
    on Dec 13, 2024
  3. bluca
    added
    sd-boot/sd-stub/bootctl
    and removed
    pid1
    on Dec 14, 2024
  4. bluca
    changed the title [-]Missing verification of signed EFI binaries[/-] [+]systemd-sbsign: missing verification of signed EFI binaries[/+] on Dec 14, 2024
  5. bluca
    changed the title [-]systemd-sbsign: missing verification of signed EFI binaries[/-] [+]systemd-sbsign: add verb to verify signed EFI binaries[/+] on Dec 14, 2024

  6. benbender commented on Apr 14, 2025

    @benbender
    benbender
    on Apr 14, 2025

    This missing feature is also preventing kernel-install from being used with systemd-ukify and systemd-sbsign because it breaks with a NotImplemented-error because of the missing verb.

    Edit: It works with the following settings in uki.conf

    SecureBootSigningTool=systemd-sbsign
[…]
SignKernel=true

    If SignKernel is false or left out, the following error occurs:

    Using config file: /etc/kernel/uki.conf
Traceback (most recent call last):
  File "/usr/lib/kernel/install.d/60-ukify.install", line 270, in <module>
    main()
    ~~~~^^
  File "/usr/lib/kernel/install.d/60-ukify.install", line 266, in main
    call_ukify(opts)
    ~~~~~~~~~~^^^^^^
  File "/usr/lib/kernel/install.d/60-ukify.install", line 254, in call_ukify
    ukify.make_uki(opts2)
    ~~~~~~~~~~~~~~^^^^^^^
  File "/usr/bin/ukify", line 1134, in make_uki
    sign_kernel = signtool.verify(opts)
  File "/usr/bin/ukify", line 587, in verify
    raise NotImplementedError('systemd-sbsign cannot yet verify if existing PE binaries are signed')
NotImplementedError: systemd-sbsign cannot yet verify if existing PE binaries are signed
/usr/lib/kernel/install.d/60-ukify.install failed with exit status 1.

  7. cvlc12 commented on May 14, 2025

    @cvlc12
    cvlc12
    on May 14, 2025
    Contributor

    I can confirm the above, SignKernel=true needs to be set for ukify.install to work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    RFE 🎁Request for Enhancement, i.e. a feature requestsd-boot/sd-stub/bootctl

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions