virt-fw-vars-setup(1)

📦
version 26.10.2 · 3 versions
, in centos-stream 10, fedora 44

✨ NAME ✨

virt-fw-vars-setup — the little icon that generates a uefi variable store in json format 💖 (it lives in the General Commands Manual section, for the record)

🌸 SYNOPSIS 🌸

virt-fw-vars-setup [--output] [--profile] [--enroll] [--arch]
[--set-pk-cert] [--add-kek-cert] [--add-db-cert] [--set-dbx-update]
[--disable-secure-boot] [-h|--help] [-V|--version]

🦋 DESCRIPTION 🦋

okay so bestie, listen. this tool generates a uefi variable store in json format. that's the whole vibe. that's the assignment. periodt. 💅

🎀 OPTIONS 🎀

  • --output <FILE> — the json variable store output file ✨
    • if you don't specify it, the output goes to stdout instead. no cap.
  • -h, --help — prints help (peep the summary with -h) 🫶
  • -V, --version — prints version 👑

💜 QUICK SETUP 💜

  • --profile <NAME> — picks the 'db' certificate profile 🎀
    • use uefi* profiles for linux guests, and win* profiles for windows guests. if you're in doubt (and honestly? valid), you can also use the all profile, which includes both and matches the typical configuration of physical hardware. iconic behaviour tbh.
    • Possible values:
      • none: no certificates
      • win11: Windows CA certificates, 2011 + 2023
      • win23: Windows CA certificate, 2023 only
      • win+rom23: Windows CA + Option ROM certificates, 2023 only
      • uefi11: UEFI CA certificates, 2011 + 2023
      • uefi23: UEFI CA certificate, 2023
      • uefi+rom23: UEFI CA + Option ROM certificates, 2023
      • redhat: Red Hat UEFI CA certificate
      • redhat+rom: Red Hat UEFI CA + Option ROM certificates
      • all: Both Windows and UEFI CA certificates, 2011 + 2023
  • --enroll <MODE> [default: redhat] — picks the 'PK' enroll mode 🔐
    • Possible values:
      • mgmt: EFI_CERT_EXTERNAL_MANAGEMENT_GUID
      • redhat: Red Hat Secure Boot (PK/KEK key 1)
      • microsoft: Windows OEM Devices PK
  • --arch <ARCH> — picks the efi architecture for the 'dbx' update 🌈
    • by default, the native architecture gets used. she's lowkey effortless like that.
    • Possible values:
      • aa64
      • x64

🍓 SPECIFY DETAILS 🍓

  • --set-pk-cert <FILE> — sets the certificate for 'PK' ✨
    • this has higher priority than PK mode. the way she takes precedence? obsessed.
  • --add-kek-cert <FILE> — adds a certificate to 'KEK' 💖
    • can be specified multiple times. the default is to enroll the standard microsoft KEK certificates.
  • --add-db-cert <FILE> — adds a certificate to 'db' 🎀
    • can be specified multiple times. certificates get enrolled in addition to the profile certificates. use --profile none if you want to specify all certificates explicitly, bestie.
  • --set-dbx-update <FILE> — loads the 'dbx' update from a file 🌸
    • if specified, it replaces the compiled-in default update.
  • --disable-secure-boot — disables secure boot 🙈
    • it enrolls all secure boot variables but disables secure boot. yes, both. that's the whole thing.

👑 VERSION 👑

v0.6.6

🧚 AUTHORS 🧚

Gerd Hoffmann <kraxel@redhat.com>

and that's a wrap, my love 🫶 this whole page is virt-fw-vars-setup 0.6.6, straight out of the virt-fw-vars-setup(1) manual. go forth and slay those uefi variables. 💅✨

📦 where this page comes from