Bug#989463: provide /var/lib/shim-signed/mok/MOK.(priv|pem|der)
On Thu, 18 Nov 2021, Thomas Goirand wrote:
On 11/17/21 11:01 AM, Tomas Pospisek wrote:
Our instructions on Secure Boot [1] are a bit scatterbrained and do not
specify precisely where the key should exist at.
I was the one who wrote them, after *A LOT* of research about it on the
internet. It was hard to find, really.
I just explained how to sign, with no intention to have this automated
(at the time), so no wonder there's no standard path...
I did not intend my characterisation of the instructions as a critique
of your work. I am extremely happy that you actually *did* the work for
all of us so we can stand on the shoulders of what you did. Very much +1
and many thanks really!!!
(And thanks & cheers to the Debian EFI Team as well :-D !!!!)
I would edit those instruction so that they create the key at the same
location Ubuntu has its MOK keys. However I would prefer not to collide
with some tools or automation or scripts that do the same at the same
place.
Please go ahead, and explain that this is the Ubuntu path.
Done.
I think it'd be preferable if Debian created (or however Ubuntu does it)
it's key automatically at that same place as Ubuntu has them, which
would make most of the instructions in the wiki [1] unnecessary and
would make the user experience much easier and smoother since the
(upstream) virtualbox package could install and sign it's modules by
itself without any user interaction, just like it happens under Ubuntu (?).
?
Well, to begin with, I wonder why the upstream virtualbox package is
pushing its compiled modules at the wrong location, but yeah, sure!
I guess one can always talk to upstream...
Hopefully, we can have the automation to sign DKMS modules in a non-leaf
package. I would strongly suggest we get a package with a very explicit
name in it, like "dkms-automatic-mok-signing" so it would do the work. I
would absolutely *not* go the path of disabling secure boot when a DKMS
module gets installed...
Since I have not looked further I am *guessing* that Ubuntu does
the automatic creation of the MOK key in the shim-signed package. So I
think it should be possible to lift Ubuntu's work out of there and also
put it into the shim-signed package, into postinst or so.
*t
Reply to: