check-sb-signature(1)

💖 check-sb-signature(1) — the manual page, but make it cute 💖

okay bestie, welcome to General Commands Manual territory ✨ this is the page for check-sb-signature, and it is lowkey the pkcs7 signature checker for efi binaries AND efi variable updates. yes, both. she does both. 💅

---

🌸 NAME 🌸

check-sb-signature — pkcs7 signature checker for efi binaries and efi variable updates 🦋

---

✨ SYNOPSIS ✨

check-sb-signature [-l|--loglevel] [--pk-enroll] [--default-kek]
[--profile] [--cert] [--pe] [--kek] [--db] [--dbx] [-h|--help]
[-V|--version]

that's the whole vibe, no cap 👑

---

💜 DESCRIPTION 💜

pkcs7 signature checker for efi binaries and efi variable updates 🌈

like. that's it. that's the job. she checks pkcs7 signatures, for efi binaries, and for efi variable updates. iconic, honestly.

---

🎀 OPTIONS 🎀

• -l, --loglevel <LEVEL> — set loglevel. default: info ✨
• -h, --help — Print help (see a summary with '-h') 🫶
• -V, --version — Print version 💖

---

🦋 CERTIFICATE CONFIGURATION 🦋

• --pk-enroll <OPT> — select 'PK' option

Possible values:

• mgmt: EFI_CERT_EXTERNAL_MANAGEMENT_GUID
• redhat: Red Hat Secure Boot (PK/KEK key 1)
• microsoft: Windows OEM Devices PK

• --default-kek — use default 'KEK' certificates 🔐
• --profile <NAME> — select 'db' profile

Possible values:

• none: no certificates
• win11: Windows CA certificates, 2011 + 2023
• win23: Windows CA certificate, 2023 only
• win+rom23: Windows CA + Option ROM certificates, 2023 only
• uefi11: UEFI CA certificates, 2011 + 2023
• uefi23: UEFI CA certificate, 2023
• uefi+rom23: UEFI CA + Option ROM certificates, 2023
• redhat: Red Hat UEFI CA certificate
• redhat+rom: Red Hat UEFI CA + Option ROM certificates
• all: Both Windows and UEFI CA certificates, 2011 + 2023

• --cert <FILE> — load additional certificates 📜

---

🔥 VERIFY SIGNATURES 🔥

• --pe <FILE> — pe/efi binary to inspect 👀
• --kek <FILE> — KEK variable update to inspect
• --db <FILE> — db variable update to inspect
• --dbx <FILE> — dbx variable update to inspect

---

⭐ VERSION ⭐

v0.1.14

---

👑 AUTHORS 👑

Gerd Hoffmann <kraxel@redhat.com> 🫶

---

okay so that's literally everything, fr fr — every flag, every value, every default, nothing skipped, we ate and left no crumbs 💅

and the cute lil' sign-off from the bottom of the page, for the record: this page is check-sb-signature 0.1.14 and it lives in section check-sb-signature(1) 💖 bye bestie, go check some signatures 🦋✨