VIRT-FW-SIGDB(1)

📦
version 26.10 · 10 versions
, in arch rolling, centos-stream 10

💖 VIRT-FW-SIGDB(1) 💖

okay so bestie, welcome to virt-fw-sigdb — like, this is the manual page for virt-fw-sigdb version 26.10, and we're gonna get you comfy with it. no gatekeeping here, let's goooo ✨

🎀 DESCRIPTION 🎀

so the virt-fw-sigdb utility? it's the moment. it can create, modify, and print EFI signature databases 💅

and what even is that, you ask? it's the format UEFI firmware uses to store lists of certificates and authenticode hashes for binaries, living inside EFI variables like 'PK', 'KEK', 'db' and 'dbx'. iconic storage behavior, no cap 👑

usually these signature databases are embedded in EFI variable stores, so for most use cases you'll probably should check out the virt-fw-vars(1) utility instead of this one. yeah, i said it — this one's the side quest, that one's the main character 🌈

the exception to this whole rule tho? the list of root CA certificates for TLS connections, which can be passed from the host via qemu to OVMF using the etc/edk2/https/cacerts fw_cfg file. that's the special case, the one scenario where this tool is literally the it girl 💖

here's the usage, copied exactly, do not come for me:

usage: virt-fw-sigdb [-h] [-i FILE] [-o FILE] [--add-cert GUID FILE]

       [--add-hash GUID HASH] [-x] [-p]

✨ options ✨

  • -h, --help — shows this help message and then dips, exit stage left 🫶
  • -i, --input FILE — reads the efi sigdb from FILE
  • -o, --output FILE — writes the efi sigdb to FILE.
  • --add-cert GUID FILE — adds an x509 cert to the sigdb, loaded in pem format from FILE, with owner GUID. can be specified multiple times, so go off, stack 'em up 🎀
  • --add-hash GUID HASH — adds a sha256 hash to the sigdb, with owner GUID. also can be specified multiple times, repeat queen 🦋
  • -x, --extract — extracts certificates
  • -p, --print — prints the sigdb

🌸 EXAMPLES 🌸

virt-fw-sigdb --print \
    --input /etc/pki/ca-trust/extracted/edk2/cacerts.bin

look at her go 😭💖

👑 AUTHOR 👑

Gerd Hoffmann <kraxel@redhat.com> — the legend behind all this, respect on the name fr fr 🫡

and that's the whole vibe check bestie, you're basically a sigdb expert now 💅✨

🎀 signed off with love: virt-fw-sigdb 26.10, dated October 2026 — catch you in the next manpage, mwah 🎀

📦 where this page comes from