citadel/documentation/secureboot

Currently, only one implementation of Secure Boot is available out of the box,
which is using a single signed EFI application to directly boot the kernel with
an optional initramfs.

This can be added to your build either through local.conf, or via your own
custom image recipe.

If you are adding it via local.conf, set the following variables:

IMAGE_FEATURES += "secureboot"
WKS_FILE = "generic-bootdisk.wks.in"
SECURE_BOOT_SIGNING_KEY = "/path/to/your/signing/key"
SECURE_BOOT_SIGNING_CERT = "/path/to/your/signing/cert"
IMAGE_CLASSES += "uefi-comboapp"

If working with an image recipe, you can inherit uefi-comboapp directly instead
of using the IMAGE_CLASSES variable.

The signing keys and certs can be created via openssl commands. Here's an
example:
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=your-subject/" -keyout \
your-key.key -out your-key.crt -days 365 -nodes -sha256
openssl x509 -in your-key.crt -out your-key.cer -outform DER

The .crt file is your SECURE_BOOT_SIGNING_CERT, and the .key file is your
SECURE_BOOT_SIGNING_KEY.

You should enroll the .crt key in your firmware under the PK, KEK, and DB
options (methods are different depending on your firmware). If a key should ever
become invalid, enroll it under DBX to blacklist it.

The comboapp can be further manipulated in a number of ways. You can modify the
kernel command line via the APPEND variable, you can change the default UUID via
the DISK_SIGNATURE_UUID variable, and you can modify the contents of the
initramfs via the INITRD_IMAGE or INITRD_LIVE variables.

A simple Secure Boot enabled image used for testing can be viewed at:
common/recipes-selftest/images/secureboot-selftest-image-signed.bb