Can't boot to signed UKI image

[plush mason]

So I set up my PK, KEK, and db entries on the bootloader. And made patches to append to the lists the original entries that came with the computer (by converting back and forth).

So now my efivars look like this:

• PK: MyKey
• KEK: MyKey + 2xMicrosoft + Laptop manufacturer
• db: MyKey + 5xMicrosoft + Laptop Manufacturer
• dbx: Some things that came pre-excluded

I've signed the systemd-boot efi binary, and it loads no problem, and can boot Windows with secureboot capabilities perfectly.
I've also set up sbctl to use my keys to sign kernel images when remade via mkinicpio, and in theory that works too.

But when booting to linux I get this error message and I have no Idea what it could be.

[plush mason]

This is what I get when running sbctl verify

(+ all the windows junk)

[hot crown]

what happens if you sbctl sign-all, or sbctl sign <path to that unsigned file> ?

[plush mason]

My curret set up is mkinitcpio is what calls sbctl to sign the kernel images and generate my UKIs

And I have my keys configured at /etc/sbctl/sbctl.conf

[hot crown]

It's odd that it gets a green tick here but the verification fails

[plush mason]

Yeah

[hot crown]

Does it still complain at boot with that geen tick there?

[plush mason]

yep

[plush mason]

This is what I get when I enable secureboot and try to load the UKI

(Windows works fine tho, so the bootloader, that's signed with the same db keys works....)

I've also set up a pacman hook to sign the bootloader /etc/pacman.d/hooks/80-secureboot.hook

That signs these files /usr/lib/systemd/boot/efi/systemd-boot*.efi

And taht seems to be working fine

[hot crown]

What's sbverify? I don't seem to have that 🤔

[hot crown]

It should be pretty automagic. Just installing sbctl puts the hook into pacman

[hot crown]

The red error here I think is most worth chasing down. It could be that your linux-zen kernel is now signed ok (green tick), but the bootloader is not happy

That's what the red error suggests to me

[plush mason]

It's from sbsigntools

[plush mason]

Yeah haha, but I've not been able to foind anything online so far

[hot crown]

hmm 🤔

I wonder how good this tool is

I am 110% secure booting on this machine

[hot crown]

https://bbs.archlinux.org/viewtopic.php?id=309025 maybe

links to https://github.com/Foxboron/sbctl/issues/462

I think you should delete (or back up) the kernel that is complaining, re-install the kernel and give it another spin

[plush mason]

Weird thing is that my mkinitcpio is saying everything is oK

(I've disabled the sbctl config in that run

[hot crown]

This is now a uki? You were signing vmlinuz here?

Uki is easier, fwiw

Less to sign, less to go wrong

[plush mason]

I'm booting to a UKI

it just... also generates the vmlinuz.... and leaves unsigned

But I did sign it jus tto try

[hot crown]

Sorry I overlooked that it was a .efi in your first image

[plush mason]

No worries 😄

[hot crown]

The kernel doesn't need to be signed if you're using UKI, as the UKI itself gets signed

[plush mason]

I've disabled sbctl and regenerated the uki, and it just says no signature table found, so I don't think it's a double signature problem

[hot crown]

Did you enroll your keys?

[plush mason]

wdy mean enrroll?

[hot crown]

https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Creating_and_enrolling_keys

[plush mason]

I added them to the EFI vars via KeyTool

Oh I did not run those commands because I did the setup manually, as I generated the keys myself

[hot crown]

I think you should have done that from inside sbctl, so it knows where the keys live

There's import-keys ?

[plush mason]

I'll try that

[hot crown]

As an aside, seeing as you are using UKI, you could dodge the bootloader entirely, if you put the UKI at the UEFI fallback position like I do here

and here's a log-roll from reinstalling the kernel. This is the kinda thing you want to see

[plush mason]

Ahammmmmm

Interesting

[hot crown]

The plot thickens!

[plush mason]

lemme check my db cert generation

cause this is weird

[hot crown]

For my experience, I just did all of this from inside sbctl. I let it make its own keys, enroll (microsoft cosigned) and sign

like 3 or 4 commands and it was done (not saying you should do that, just describing)

[plush mason]

Wait wot

wdymean 0 bytes

[hot crown]

Very smol key 🤏

[plush mason]

I may have accidentally touched it

well, thank god I have backups XD

Also, setting up sshkeys so that I manage any of my computers from a single one is full glory

Ok I know exaclty how I botched my dk keys

[plush mason]

Well, time to test if that works

It worked!

Thanks @hot crown

[slate narwhal]

mushroom.botherer received a thank you cookie!

[plush mason]

Also, don't you happen to know how to check if things like the nviida driver are loaded?

I've haerd that when secure booting sometimes they don't load correctly and have to change some configs.

[hot crown]

nvidia-smi is the easiest way, it will complain if it's not set up

otherwise lspci -k | grep -iA3 vga will interrogate lspci and spit out the "vga" line and 3 lines after, which should say the modules and drivers that are running

[plush mason]

This keeps apperaing but it works

¯_(ツ)_/¯

Holy rabbithole XD

[hot crown]

I think that's systemd-boot 🤔

[hot crown]

This is worth considering, if you're not using the bootloader to manage snapshots or dual-booting

[plush mason]

I am dual booting windows sadly