Moving from GRUB to systemd boot

[navras]

I think the reason you had to sign the kernel (on every update) is that you signed systemd-bootx64.efi instead of shim. shim has built in Fedora key to backdoor the Secure Boot process to trust Fedora key, even if it’s not in key db.

If you sign shim, the boot goes: shim (your key, or Microsoft) → sd-boot (Fedora) → kernel (Fedora).
But you didn’t sign it and removed the Microsoft key, the boot likely doesn’t allow shim, so it goes: sd-boot (your key) → kernel (must be your key).

I think it might be a better idea to:

• Indeed, skip the shim, modifiy UEFI boot entry to point to sd-boot
• Sign sd-boot with your key
• Add Fedora public keys^[1][2] to key db along side your key

Since otherwise kernel modules and fwupd will have to be signed again as well.

EDIT:
Oh I see, shim is not installed. The boot entry already points to sd-boot.
Tried this myself, works. Used sbctl, added the fedora cert as custom, signed sd-boot with my key.

---

1. Secure Boot: Where is the Fedora MOK key installed?

   It is baked into the shim, but you can extract it using mokutil --export. You can find the original at https://src.fedoraproject.org/rpms/shim-unsigned-x64/tree/rawhide

   ↩︎

2. How to enroll fedora public key to uefi?

   I have managed to add fedora’s public key to uefi db list successfully. All I had do to is sign the fedora’s public key with my private keys and enroll it. It was easy, I already knew this before coming here but I asked here to confirm the procedure. Thanks to those people who are just asking questions like “why do you want that” “why don’t you trust microsoft?” and sounding like impossible thing to do. sudo dmesg | grep "Loaded X.509 cert" [sudo] password for arun: [ 0.609839] Loa…

   ↩︎