sicherboot(8)

📦 version 0.1.5, in ubuntu jammy

💖 sicherboot(8) 💖

okay bestie, sit down, hydrate, because we're talking about sicherboot — and no, it's not a vibe, it's an actual manual page from section 8 of the Sicherboot User Manuals. it's giving "the friend who explains secure boot to you at 2am and somehow makes it make sense." 🫶

✨ NAME ✨

sicherboot — systemd-boot integration with UEFI secure boot support 🦋

🌸 SYNOPSIS 🌸

sicherboot [command] [arg...]

like. that's it. that's the whole shape of it. a command, then whatever args that command wants. iconic. 💅

🎀 DESCRIPTION 🎀

so here's the tea: sicherboot manages the systemd-boot bootloader and the kernels, all living inside an EFI System Partition (aka the ESP, and yes it's pronounced like the vibe, iykyk).

it keeps a whole set of keys in /etc/sicherboot/keys and uses them to sign the binaries so they work with secure boot. that's the whole point. keys in, signed binaries out, secure boot happy, you happy. 💜

🔥 INITIAL SETUP 🔥

first things first, bestie. after you install sicherboot:

  • set up /etc/kernel/cmdline
  • and maybe tweak some options in /etc/sicherboot/sicherboot.conf to your liking

do that, get it looking how you want, and then run sicherboot setup to do the initial installation. that's the moment. that's the main character moment. ⭐

💫 sicherboot setup

performs the initial installation of sicherboot to the ESP. basically it runs enroll-keys, install-kernel, and bootctl install — and it asks before each step, so it's not out here doing stuff behind your back. consent king behavior. 👑

🗝️ KEY MANAGEMENT 🗝️

🔑 sicherboot generate-keys

generates keys in the directory configured in the KEY_HOME option. that's it, that's the job. ✨

📥 sicherboot enroll-keys

copies the public keys into the ESP — and if there are no keys yet, it runs generate-keys first. so thoughtful of it fr fr. 💖

🌈 KERNEL MANAGEMENT 🌈

📦 sicherboot install-kernel [VERSION]

installs the specified kernel version to the ESP, with initramfs, and signed. the whole package, no crumbs. 🔥

🗑️ sicherboot remove-kernel [VERSION]

removes the specified kernel version from the ESP. bye bestie, you served well. 😭

🛠️ OTHER TOOLS 🛠️

🌟 sicherboot bootctl [ARGUMENT...]

runs the bootctl program with whatever arguments you give it, and then signs the bootloader afterwards. two birds, one slay. 🦋

✍️ sicherboot sign-image EXECUTABLE

signs the given executable using the db key. no cap, that's literally what it does. 💅

📁 FILES 📁

  • /etc/sicherboot/sicherboot.conf — the sicherboot configuration file 🎀
  • /etc/sicherboot/keys — the default key storage location 🗝️
  • /etc/kernel/cmdline — kernel command line configuration file 🌸

👑 AUTHORS 👑

Julian Andres Klode. periodt. 💜

ok that's the whole page bestie, go secure your boot or whatever, you got this 🫶

and that's a wrap on the Sicherboot User Manuals, dated September 6, 2016 — older than some of us but still absolutely eating. mwah. 😘💖

📦 where this page comes from