Document Resource: Secureboot

I was interested in secureboot on void. One of the users on the Void Matrix group posted about it and shared how he set it up here. Not sure if pastebin autodeletes stuff so I will paste it below in full: I will make a doc PR for this after I finish relearning git so this is notes for myself or if someone else want to PR it as well.

# Secureboot guide for linux:
# Im using void but this should work on most distros. You will just have to replace stuff like xbps-install with apt for example.
0.1. Enter Root
sudo su
1. Install efitools sbsigntool
sudo xbps-install efitools efitools-efi
2.Create a GUID for owner identification
uuidgen --random > GUID.txt
3. Platform key
openssl req -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=my Platform Key/" -out PK.crt
openssl x509 -outform DER -in PK.crt -out PK.cer
cert-to-efi-sig-list -g "$(< GUID.txt)" PK.crt PK.esl
sign-efi-sig-list -g "$(< GUID.txt)" -k PK.key -c PK.crt PK PK.esl PK.auth
3.1 Sign an empty file to allow removing Platform Key when in "User Mode"
sign-efi-sig-list -g "$(< GUID.txt)" -c PK.crt -k PK.key PK /dev/null rm_PK.auth
4. Key Exchange Key
openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=my Key Exchange Key/" -out KEK.crt
openssl x509 -outform DER -in KEK.crt -out KEK.cer
cert-to-efi-sig-list -g "$(< GUID.txt)" KEK.crt KEK.esl
sign-efi-sig-list -g "$(< GUID.txt)" -k PK.key -c PK.crt KEK KEK.esl KEK.auth
5. Signature Database key
openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj "/CN=my Signature Database key/" -out db.crt
openssl x509 -outform DER -in db.crt -out db.cer
cert-to-efi-sig-list -g "$(< GUID.txt)" db.crt db.esl
sign-efi-sig-list -g "$(< GUID.txt)" -k KEK.key -c KEK.crt db db.esl db.auth
6. Signing Bootloader and Kernel. (I use grub)
sbsign --key db.key --cert db.crt --output /boot/vmlinuz(enter version here) /boot/vmlinuz(enter version here)
sbsign --key db.key --cert db.crt --output /boot/efi/EFI/BOOT/BOOTX64.EFI /boot/efi/EFI/BOOT/BOOTX64.EFI
7. Enroll your keys
cp /root/*.cer /root/*.esl /root/*.auth /boot/efi/

Follow this guide: https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot#Method_3:_Inserting_Keys_via_Keytool

Keys should be added in this order: db => KEK => PK

8. Enable SecureBoot and Enjoy!

Beginne damit, die Secure-Boot-Befehle in diesem Issue und den verlinkten Gentoo-Leitfaden zur Schlüsselregistrierung zu prüfen und dabei zu kontrollieren, welche Schritte und Paketnamen für Void Linux gelten. Die Arbeit ist abgeschlossen, wenn die mdBook-Dokumentation einen klaren, validierten Leitfaden zur Einrichtung von Secure Boot enthält, in dem die Reihenfolge der Schlüsselregistrierung und die Signaturschritte erklärt werden.