BootC: How can I sign shim and kernel with own keys?

Ask Fedora
, ,
1

Hello.

I made some bootc images for embedded systems and want to sign kernel and shim with my own keys. Consider the keys existing and the enrollment in UEFI as done. This works with a concentional system, only shim/kernel signed by me boot.

Now: How can I sign shim and kernel during a bootc container build.
I should probably better ask: Where the files are which I can sign?

/boot is empty in side the image, but the files should be anywhere anyways.

Thanks in advance.

Kind regards,

Dirk

2

The kernel and the initrd are in /usr/lib/modules/<version>/ (vmlinuz & initramfs.img). Shim & GRUB are in /usr/lib/bootupd/updates/EFI.

You can re-sign them using pesign / sbsigntools in your Containerfile.