SYSTEMD-SBSIGN(1)

💖 SYSTEMD-SBSIGN 💖

okay bestie, welcome to the systemd-sbsign(1) page — yes that's the manual name, no we're not skipping it. this is the little tool that signs your PE binaries so EFI Secure Boot will actually let them through the door. let's get into it 🫶

---

✨ SYNOPSIS ✨

systemd-sbsign [OPTIONS...] {COMMAND}

---

🌸 DESCRIPTION 🌸

systemd-sbsign can be used to sign PE binaries for EFI Secure Boot. that's the whole vibe. you hand it a PE binary, it signs it, Secure Boot stops side-eyeing you. slay.

---

👑 COMMANDS 👑

• sign — signs the given PE binary for EFI Secure Boot. takes a path to a PE binary as its argument. if the PE binary already has a certificate table, the new signature gets added to it — no erasing, no drama. otherwise a brand new certificate table gets created. the signed PE binary gets written to the path you specified with --output=. ✨

Added in version 257. (yes, it's a baby but it's thriving)

---

💅 OPTIONS 💅

here's everything it understands, no gatekeeping:

• --output=PATH — tells it where to write the signed PE binary, or the data to be signed offline when you're using the --prepare-offline-signing option. so: output location, your call.

Added in version 257.

• --private-key=PATH/URI, --private-key-source=TYPE[:NAME], --certificate=PATH, --certificate-source=TYPE[:NAME] — these set the Secure Boot private key and certificate for use with the sign verb. let me break it down, bestie:
  • --certificate= takes a path to a PEM-encoded X.509 certificate, or a URI that gets passed to the OpenSSL provider configured with --certificate-source=.
  • --certificate-source= takes one of "file" or "provider", and with the latter you follow it with a specific provider identifier, separated with a colon, e.g. "provider:pkcs11".
  • --private-key= takes a path or a URI that will be passed to the OpenSSL engine or provider, as specified by --private-key-source= as a "type:name" tuple, such as "engine:pkcs11".
  • the specified OpenSSL signing engine or provider is what actually does the signing of the PE binary. iconic delegation fr.

Added in version 258. wait no — Added in version 257. 😭 (that's what it says, and we respect the source)

ok real talk, the original says Added in version 257 for this one. keeping it exact. 💖

• --prepare-offline-signing — when you pass this, the sign command writes the data that should be signed to the path specified with --output= instead of writing the signed PE binary. then you can sign that data out of band, and afterwards attach the signature to the PE binary using the --signed-data= and --signed-data-signature= options. it's giving "sign it somewhere else, bring it back later". 💌

Added in version 258.

• --signed-data=PATH, --signed-data-signature=PATH — configure the signed data (the stuff written to the path from --output= when you used --prepare-offline-signing) and the corresponding signature, for the sign command. this is the "bring it back and attach it" step. 🎀

Added in version 258.

• -h, --help — print a short help text and exit. classic.
• --version — print a short version string and exit. also classic.

---

🌈 EXAMPLES 🌈

🦋 Example 1. Offline EFI secure boot signing of a PE binary

the following does offline secure boot signing of systemd-boot:

SD_BOOT="$(find /usr/lib/systemd/boot/efi/ -name "systemd-boot*.efi" | head -n1)"
# Extract the data that should be signed offline.
/usr/lib/systemd/systemd-sbsign \
    sign \
    --certificate=secure-boot-certificate.pem \
    --output=signed-data.bin \
    --prepare-offline-signing \
    "$SD_BOOT"
# Sign the data out-of-band. This step usually happens out-of-band on a separate system.
openssl dgst -sha256 -sign secure-boot-private-key.pem -out signed-data.sig signed-data.bin
# Attach the signed data and its signature to the systemd-boot PE binary.
/usr/lib/systemd/systemd-sbsign \
    sign \
    --certificate=secure-boot-certificate.pem \
    --output="$SD_BOOT.signed" \
    --signed-data=signed-data.bin \
    --signed-data-signature=signed-data.sig \
    "$SD_BOOT"

no cap, that second step usually happens out-of-band on a separate system — that's the whole point of doing it offline, bestie. 🔥

---

🧚 SEE ALSO 🧚

bootctl(1) — go read it, it's right there. 💜

---

and that's the page!! this beauty is from systemd 262.1, and it's the SYSTEMD-SBSIGN(1) manual page. go forth and sign your binaries, you main character. 🎀✨💅