SBVARSIGN(1)

📦
version 0.9.5 · 15 versions
, in alpine 3.23, alpine 3.24, fedora 43

💖 NAME 💖

sbvarsign - UEFI authenticated variable signing tool. Hiii bestie, welcome to the SBVARSIGN(1) page — this is where we sign UEFI authenticated variable data and feel extremely iconic about it. 🎀✨

🌸 SYNOPSIS 🌸

Okay so the command shape is literally:

sbvarsign [options] --key <keyfile> --cert <certfile> <var-name> <var-data-file>

🦋 DESCRIPTION 🦋

The main quest: sign a blob of data for use in SetVariable(). That's the whole assignment, and honestly? Slay. 💅

✨ OPTIONS ✨

  • --engine <eng> — use the specified engine to load the key. very “pick your loader, bestie” energy. 🔥
  • --key <keyfile> — the signing key, which is a PEM-encoded RSA private key. guard it like your most sacred screenshot folder, ngl. 🗝️💖
  • --cert <certfile> — the certificate, specifically an x509 certificate. 🎀
  • --include-attrs — include attrs at the beginning of the output file. yes, attrs, at the beginning, front and center. ✨
  • --guid <GUID> — the EFI GUID for the variable. If you omit it, EFI_IMAGE_SECURITY_DATABASE or EFI_GLOBAL_VARIABLE will be used, depending on <var-name>. iykyk, it picks based on the variable name. 🦋
  • --attr <attrs> — the variable attributes. One or more of:
    • NON_VOLATILE
    • BOOTSERVICE_ACCESS
    • RUNTIME_ACCESS
    • TIME_BASED_AUTHENTICATED_WRITE_ACCESS
    • APPEND_WRITE

Separate multiple attrs with a comma. Default is all attributes, and TIME_BASED_AUTH... is always included. periodt. 💅

  • --output <file> — write signed data to <file>. Default is <var-data-file>.signed, so it’ll make that signed version for you unless you say otherwise. 💾✨

Cute little footer sign-off: sbvarsign 0.9.5, July 2025 — SBVARSIGN(1) out, bye bestie, go be iconic with your signed blob 🫶💖🌈

📦 where this page comes from