Skip to content

xdbob/sbtools

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

29 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

sbtools

Helpers for generating signed Arch Linux kernels for Secure Boot. And pacman hook for auto-generation.

Installation

Use sb-mkkeys to generate your own Secure Boot keys in the current directory.

Use sb-make-boot-img to combine the kernel intiramfs and boot args into a single efi binary (see sb-make-boot-img -h for help).

Use sb-sign-binary to sign a binary using your keys (see sb-sign-binary -h for help).

See How to install the efi keys.

Configuration file

The configuration file should be located at /etc/sbtools.conf and can be used to prefill some of the tools arguments (they will be overriten if the command line args are present).

the options are in the format: <name>=<path>

List of the different possible options:

  • cmd: Kernel command-line file.
  • outdir: Efi binary output dir (only used by the pacman hook)
  • out: Efi binary output file (not used by the pacman hook)
  • osrel: osrel file
  • efistuf: efistub file
  • keysdir: Location of the Secure boot keys
  • kernel: Location of the kernel to use (will break the pacman hook)
  • initrd: Initramfs to use
  • addinitrd: Additional initramfs (like microcode).

Pacman hook

For the pacman hook to work the configuration file /etc/sbtools.conf must be updtated accordingly to your setup.

The mandatory options needed to run the pacman hook are:

  • cmd
  • outdir
  • keysdir
  • osrel
  • efistuf

For each kernel /boot/vmlinuz-<NAME> the pacman-hook will generate <OUTDIR>/<NAME>.efi with defined in the previously mentionned configuration file.

Known bugs

The LZOP compression for the initramfs is not supported.

About

Secure boot helper tools.

Resources

License

Stars

Watchers

Forks

Packages

No packages published