SBSIGN(1)

📦
version 0.9.5 · 15 versions
, in alpine 3.23, alpine 3.24, fedora 43

💅 SBSIGN 💅

ok so real talk, this is sbsign from section 1 of the manual (User Commands, bestie, we're in the big leagues) — it's the UEFI secure boot signing tool and honestly? she's iconic. let's get into it 🫶

✨ NAME ✨

sbsign — the UEFI secure boot signing tool. that's it, that's the whole vibe. she signs things so your machine will actually trust them 🔥

🌸 SYNOPSIS 🌸

sbsign [options] --key <keyfile> --cert <certfile> <efi-boot-image>

like, options go first, then you gotta have your key and your cert, then the EFI boot image you're signing. no cap 💖

🦋 DESCRIPTION 🦋

okay so what does she actually do? literally this: sign an EFI boot image for use with secure boot.

that's the whole job. she takes your boot image, she signs it, and now secure boot is like "oh period, i trust this one." main character energy only 👑

🎀 OPTIONS 🎀

  • --engine <eng> — use the specified engine to load the key. you're handing the key-loading job off to eng, and honestly, delegation is self-care ✨
  • --key <keyfile> — your signing key. and bestie, it's gotta be a PEM-encoded RSA private key, like that's non-negotiable. guard this file with your life fr fr 🔐
  • --cert <certfile> — your certificate. specifically an x509 certificate. she pairs with the key up there, they're a matching set 💜
  • --addcert <addcertfile> — additional intermediate certificates in a file. yes additional, yes intermediate, yes you can bring your whole friend group 🌈
  • --detached — write a detached signature, instead of a signed binary. so the sig goes in its own little file instead of riding along inside the binary. independent queen behaviour 💅
  • --output <file> — write signed data to <file>. and here's the default tea ☕: it's <efi-boot-image>.signed, or <efi-boot-image>.pk7 for detached signatures. so if you don't specify, she picks for you, and she picks correctly 🎀
heads up bestie: the default output name depends on whether you passed --detached — .signed normally, .pk7 when it's detached. don't get caught out 🙈

🧚 a lil sign-off 🧚

and that's the whole page!! you read the entire thing, i'm so proud of you 😭🫶 this beauty is from sbsign 0.9.5, dated July 2025 — scream it from the rooftops, cite it in your notes, whatever, just remember it 💖✨

now go sign something. slay 🎀

📦 where this page comes from