Secure Boot Support

[mrveiss]

Overview

Support for UEFI Secure Boot with signed bootloaders and kernels.

Requirements

• Signed shim bootloader
• Signed GRUB
• MOK (Machine Owner Key) management
• Certificate enrollment workflow
• Signed kernel images

Workflow

1. Enroll PureBoot certificate in MOK
2. Chain: shim → signed GRUB → signed kernel
3. Verify signatures at each stage

Technical Details

• sbsign for signing binaries
• mokutil for key management
• Certificate generation and storage
• Key rotation procedures

Priority

LOW - Enterprise security feature

Related

• UEFI Boot Support with GRUB Chainloading #39 UEFI Boot Support
• Build Unified Kernel Images (UKI) for UEFI Direct Boot #40 Unified Kernel Images