Document Resource: Secureboot

I was interested in secureboot on void. One of the users on the Void Matrix group posted about it and shared how he set it up here. Not sure if pastebin autodeletes stuff so I will paste it below in full: I will make a doc PR for this after I finish relearning git so this is notes for myself or if someone else want to PR it as well.

# Secureboot guide for linux:
# Im using void but this should work on most distros. You will just have to replace stuff like xbps-install with apt for example.
0.1. Enter Root
sudo su
1. Install efitools sbsigntool
sudo xbps-install efitools efitools-efi
2.Create a GUID for owner identification
uuidgen --random > GUID.txt
3. Platform key
openssl req -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=my Platform Key/" -out PK.crt
openssl x509 -outform DER -in PK.crt -out PK.cer
cert-to-efi-sig-list -g "$(< GUID.txt)" PK.crt PK.esl
sign-efi-sig-list -g "$(< GUID.txt)" -k PK.key -c PK.crt PK PK.esl PK.auth
3.1 Sign an empty file to allow removing Platform Key when in "User Mode"
sign-efi-sig-list -g "$(< GUID.txt)" -c PK.crt -k PK.key PK /dev/null rm_PK.auth
4. Key Exchange Key
openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=my Key Exchange Key/" -out KEK.crt
openssl x509 -outform DER -in KEK.crt -out KEK.cer
cert-to-efi-sig-list -g "$(< GUID.txt)" KEK.crt KEK.esl
sign-efi-sig-list -g "$(< GUID.txt)" -k PK.key -c PK.crt KEK KEK.esl KEK.auth
5. Signature Database key
openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj "/CN=my Signature Database key/" -out db.crt
openssl x509 -outform DER -in db.crt -out db.cer
cert-to-efi-sig-list -g "$(< GUID.txt)" db.crt db.esl
sign-efi-sig-list -g "$(< GUID.txt)" -k KEK.key -c KEK.crt db db.esl db.auth
6. Signing Bootloader and Kernel. (I use grub)
sbsign --key db.key --cert db.crt --output /boot/vmlinuz(enter version here) /boot/vmlinuz(enter version here)
sbsign --key db.key --cert db.crt --output /boot/efi/EFI/BOOT/BOOTX64.EFI /boot/efi/EFI/BOOT/BOOTX64.EFI
7. Enroll your keys
cp /root/*.cer /root/*.esl /root/*.auth /boot/efi/

Follow this guide: https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot#Method_3:_Inserting_Keys_via_Keytool

Keys should be added in this order: db => KEK => PK

8. Enable SecureBoot and Enjoy!

Commencez par examiner les commandes Secure Boot de cette issue et le guide Gentoo lié concernant l’enregistrement des clés, en vérifiant quelles étapes et quels noms de paquets s’appliquent à Void Linux. Le travail est terminé lorsque la documentation mdBook contient un guide clair et validé de configuration de Secure Boot, dans lequel l’ordre d’enregistrement des clés et les étapes de signature sont expliqués.