{"id":13681499,"url":"https://github.com/aneesh-neelam/UEFI-SecureBoot-SignTool","last_synced_at":"2025-04-30T03:31:35.159Z","repository":{"id":76211422,"uuid":"89032180","full_name":"aneesh-neelam/UEFI-SecureBoot-SignTool","owner":"aneesh-neelam","description":"Script to sign external Linux kernel modules for UEFI Secure Boot. ","archived":false,"fork":false,"pushed_at":"2019-10-24T15:12:24.000Z","size":23,"stargazers_count":27,"open_issues_count":2,"forks_count":5,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-21T17:42:05.964Z","etag":null,"topics":["linux-kernel","linux-kernel-module","secure-boot","uefi"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aneesh-neelam.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2017-04-21T23:52:00.000Z","updated_at":"2025-04-10T11:44:49.000Z","dependencies_parsed_at":"2023-03-11T21:52:49.686Z","dependency_job_id":null,"html_url":"https://github.com/aneesh-neelam/UEFI-SecureBoot-SignTool","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aneesh-neelam%2FUEFI-SecureBoot-SignTool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aneesh-neelam%2FUEFI-SecureBoot-SignTool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aneesh-neelam%2FUEFI-SecureBoot-SignTool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aneesh-neelam%2FUEFI-SecureBoot-SignTool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aneesh-neelam","download_url":"https://codeload.github.com/aneesh-neelam/UEFI-SecureBoot-SignTool/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251635300,"owners_count":21619204,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["linux-kernel","linux-kernel-module","secure-boot","uefi"],"created_at":"2024-08-02T13:01:31.600Z","updated_at":"2025-04-30T03:31:34.926Z","avatar_url":"https://github.com/aneesh-neelam.png","language":"Shell","funding_links":[],"categories":["Tools :hammer:","Shell"],"sub_categories":[],"readme":"# UEFI Secure Boot sign tool\n\nThe default signed Linux kernel on [Ubuntu](https://www.ubuntu.com/) (\u003e=16.04.x), [Fedora](https://getfedora.org/) and perhaps on other distributions as well, won't load unsigned external kernel modules if Secure Boot is enabled on [UEFI](https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface) systems.\nHence, any external kernel modules like the proprietary [Nvidia kernel driver](https://www.nvidia.com/object/unix.html), [Oracle VM VirtualBox](https://www.virtualbox.org/)'s host/guest kernel driver etc. won't work.\n\nExternal kernel modules must be signed for UEFI Secure Boot using a Machine Owner Key (MOK).\nThis is useful if you can't or don't wish to disable Secure Boot on your UEFI-enabled system.\n\nUEFI Secure Boot Sign Tool can be used to sign kernel modules.\nEssentially, it is a wrapper around the sign-file binary in the kernel sources.\n\nThe systemd service can be enabled to automatically sign specific kernel modules with user's own once setup is complete.\n\n### Install and Setup\n\nFedora Dependencies:\n* kernel-devel\n* mokutil\n* openssl\n* Any text editor\n\nExtract/Install the files in their respective locations. Download installation script from the [releases page](https://github.com/aneesh-neelam/UEFI-SecureBoot-SignTool/releases) and run install.sh as root.\n\n    # ./install.sh\n\n\n###### Generating a Public and Private X.509 Key Pair:\n\nGenerate a X.509 Key Pair as the UEFI Secure Boot Machine Owner Key.\n\n    $ openssl req -new -x509 -newkey rsa:2048 -keyout \"/etc/sb-signtool/keyfiles/sb.priv\" -outform DER -out \"/etc/sb-signtool/keyfiles/sb_pub.der\" -nodes -days 36500 -subj \"/CN=\u003cyour name\u003e/\"\n\n###### Import Public Key into UEFI-enabled System:\n\n    # mokutil --import \"/etc/sb-signtool/sb_pub.der\"\n\n###### Edit the UEFI Secure Boot Sign Tool config file(s):\n\nMust edit the following file before running script:\n\n    /etc/sb-signtool/modules.conf\n\nYou can check out an example file in the [documentation](https://github.com/aneesh-neelam/UEFI-SecureBoot-SignTool/blob/master/usr/share/doc/sb-signtool/example_modules.conf).\n\n### Usage\n\nMust run the Signing Tool every time a kernel module is rebuilt or when a new kernel is installed.\nOr enable the systemd service to do that on boot.\n\n###### Run the UEFI Secure Boot Signing Tool:\n\n    # /usr/bin/sb-signtool-sign\n\n###### Enable the systemd service:\n\n    # systemctl enable sb-signtool.service\n\n\n### TODO\n\n* Packaging and distribution for Ubuntu, Fedora, Arch Linux etc.\n\n\n## Contributing and License\n\nFeel free to create GitHub Issues and issue Pull Requests to contribute to this project.\n\nCode released under [GNU General Public License v2.0](https://github.com/aneesh-neelam/uefi-sb-signtool/blob/master/LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faneesh-neelam%2FUEFI-SecureBoot-SignTool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faneesh-neelam%2FUEFI-SecureBoot-SignTool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faneesh-neelam%2FUEFI-SecureBoot-SignTool/lists"}