SecureBoot Keys

[xnox]

Are there any signatures on the kernel?

Or should I self sign & enroll?

Even ephemeral keys one would help.

[stgraber]

Currently it's all ephemeral keys at build time, but I think we should be able to generate a key, dump it as a Github Actions Secret and have the kernel build use that instead.

As everything is built on private Github Runners (ephemeral Github instances), that should be fine, so long as Github itself doesn't get compromised (but then we'd have other problems).

[xnox]

Honestly I would be very happy to get ephemeral Sigstore Cosign cert that has 15min validity https://docs.sigstore.dev/quickstart/quickstart-cosign/ to embed as trusted cert into kernel; and sign the kernel and modules with it. (and use faketime to keep the signing time within the validity time, cause kexec checks that). And then such cert is easy to include into moklist to trust.

Also hoping in the future to have sigstore policies in kernel to allow users to specify "trust sigstore cert with these attestations".

[thetredev]

For what it's worth, I have this script to do it myself all the time after each kernel upgrade:

#!/bin/bash

set -e


kernel_version=${1:-$(uname -r)}

source_image="/boot/vmlinuz-${kernel_version}"

# ensure that the source image exists
if [[ ! -f ${source_image} ]]; then
  echo "Source image file '${source_image}' does not exist. Aborting verify/sign!"
  exit 1
fi

temp_image="${source_image}.tmp"

# ----->
# these were generated manually using /sbin/dkms generate_mok
sign_key=/var/lib/dkms/mok.key
sign_cert_binary=/var/lib/dkms/mok.pub
# <-----

sign_cert_pem=/var/lib/dkms/mok.pem

# sbverify and sbsign want the MOK cert in PEM format
# so create it if it doesn't exist yet
test -f ${sign_cert} || openssl x509 -in ${sign_cert_binary} -outform PEM -out ${sign_cert_pem}

# do nothing if the source image was already signed
sbverify --cert ${sign_cert_pem} ${source_image} && exit 0

# otherwise sign the image
sbsign --key ${sign_key} --cert ${sign_cert_pem} ${source_image} --output ${temp_image}

# ... and replace the original unsigned source image with the signed one
mv ${temp_image} ${source_image}

This obviously isn't going to sit well in enterprise environments, but for home/homelab usage who cares lol.