SIGN-EFI-SIG-LIST(1)

💖 sign-efi-sig-list — the secure-variable signing bestie 💖

okay so this is sign-efi-sig-list, a User Commands girlie from the sign-efi-sig-list 1.9.2 era, and she is literally the signing tool for secure variables as EFI Signature Lists. no cap. 🎀

---

✨ NAME ✨

sign-efi-sig-list — signing tool for secure variables as EFI Signature Lists. that's the whole vibe. 💅

---

🦋 SYNOPSIS 🦋

sign-efi-sig-list [-r] [-m] [-a] [-g <guid>] [-o] [-t <timestamp>] [-i
<infile>] [-c <crt file>] [-k <key file>] [-e <engine>] <var> <efi sig
list file> <output file>

---

🌸 DESCRIPTION 🌸

bestie, what she does is produce an output file with an authentication header for direct update to a secure variable. iconic behavior.

this output may be signed by the usual keys directly, or it may be split for external signing using the -o and -i options. yes, she can do both. main character energy fr fr. ✨

---

💜 OPTIONS 💜

• -r — the certificate is rsa2048 rather than x509. [UNIMPLEMENTED] so like… do not count on it, bestie. 😭
• -m — Use a monotonic count instead of a timestamp. [UNIMPLEMENTED] same warning, she is not doing this one yet. 💀
• -a — Prepare the variable for APPEND_WRITE rather than replacement. this is the "add to it" flag, not the "replace the whole thing" flag. 🫶
• -o — Do not sign, but output a file of the exact bundle to be signed. detached-signing girlies, this one's for you. 💖
• -t <timestamp> — Use <timestamp> as the timestamp of the timed variable update. If not present, then the timestamp will be taken from system time. ⏰

Note you must use this option when doing detached signing otherwise the signature will be incorrect because of timestamp mismatches. like, must must. no cap. 😭

• -i <infile> — take a detached signature (in PEM format) of the bundle produced by -o and complete the creation of the update. yes, this is the part two of the detached-signing saga. 🧚
• -g <guid> — Use <guid> as the signature owner GUID. give the signature its own little name tag. 🎀
• -c <crt> — <crt> is the file containing the signing certificate in PEM format. 🌈
• -k <key> — <key> is the file containing the key for <crt> in PEM format. she needs both, bestie. 🔑
• -e <engine> — Use openssl engine <engine> for the private key. engine girlie behavior. 🔥

---

⭐ EXAMPLES ⭐

okay so first: to sign a simple append update to db which has been prepared as an EFI Signature List in DB.esl and output the result with the authentication header in DB.auth:

sign-efi-sig-list -a -c KEK.crt -k KEK.key db DB.esl DB.auth

To do a detached signature in the same way:

sign-efi-sig-list -a -t 'Jul 21 09:39:37 BST 2012' -o db DB.esl
DB.forsig

Now sign the DB.forsig file in the standard openssl way. Note that the standards require sha256 as the signature algorithm:

openssl smime -sign -binary -in DB.forsig -out DB.signed -signer KEK.crt
-inkey KEK.key -outform DER -md sha256

Which produces a detached PKCS7 signature in DB.signed. Now feed this back into the program remembering to keep the same timestamp (and the -a flag):

sign-efi-sig-list -a -i DB.signed -t 'Jul 21 09:39:37 BST 2012' db
DB.auth

To delete a key, simply sign an empty EFI signature list file, so to produce an variable update that will delete the PK:

> null.esl

And then sign it in the standard way (must not be an append write update):

sign-efi-sig-list -c PK.crt -k PK.key PK null.esl PK.auth

Once you have the .auth file conveyed to the UEFI platform, you can use the UpdateVars.efi program to apply it:

UpdateVars [-a] db DB.auth

Where the -a flag must be present if the DB.auth file was created as an append write update and absent if its replacing the variable. yes bestie, presence/absence of -a is literally the vibe check here. 💅

---

👑 SEE ALSO 👑

cert-to-efi-sig-list(1) for details on how to produce EFI signature lists. go read her next, she's iconic too. 🦋

---

and that's the page, bestie! brought to you by sign-efi-sig-list 1.9.2, dated March 2024 — mwah, slay, periodt. 💖✨🎀