Garrett: Handling UEFI Secure Boot in smaller distributions

[Posted October 10, 2012 by ris]

Matthew Garrett looks at UEFI secure boot in smaller distributions. "I've taken Suse's code for key management and merged it into my own shim tree with a few changes. The significant difference is a second stage bootloader signed with an untrusted key will cause a UI to appear, rather than simply refusing to boot. This will permit the user to then navigate the available filesystems, choose a key and indicate that they want to enrol it. From then on, the bootloader will trust binaries signed with that key."