Enabling UEFI Secure Boot Across Modern Build Systems
summary
Modern distros rely on shim signed by Microsoft to boot on commodity x86 hardware, inserting a distro key while preserving Microsoft as the initial root; that works but creates a structural dependency and complex review flow. Build systems solve private-key handling with HSM/PKCS11-backed signing or short‑lived CI tokens and Vault-style brokers; Fedora, Ubuntu and Debian use HSMs, Fedora routes secure‑boot jobs to isolated servers. Manual routes use mok enrollment via firmware UI or USB keys; self‑signing remains practical only for embedded or power‑user workflows.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 3:14UEFI firmware and secure boot
- 7:10Shim and MOK in practice
- 15:44Problem with private key management
- 20:03Cloud-native key management solutions
- 21:34How distros handle key security
- 25:25Key expiration and revocation
- 26:11OBS signed and HSMs
- 29:47Alternative signing methods
related talks
45mUsing Secure Boot for the powers of good
38mUEFI Secure Boot in U-Boot
27mSecure Boot auto enrollment
22mBoot Requirements and Strategies for the Edge
46mVerifiable End To End Secure OCI Native Machines
42mPractical Application of Verified Boot
33mOpenPOWER: Host OS (Linux Kernel) Secure Boot Key Management
27mSecuring Arm Servers