About grub signing config files

About grub signing config files

[Felix Rubio Dalmau]

Hi everybody (and happy 2021)!

I have just installed debian stable, with Grub2. I want to make full use of secure boot and kernel/initramfs/grub config files signing, but I have have not been able to find an "already maintained" way to do it.

I think I have come with a minimal set of changes that a) provide the grub config file signing, and b) break nothing (I think), and I want to share them with you so that maybe they can be included in upstream grub? The assumptions are that a) gpg is installed, and b) the default name format for the signature files (so, ending in .sig is used).

In short, it boils down to
a) defining a variable GRUB_SIGNING_KEY with the fingerprint of the key to be used.
b) add this to grub-mkconfig
###########
if [ "x${GRUB_SIGNING_KEY}" != "x" -a "x${grub_cfg}" != "x" ]; then
    gpg --yes --default-key ${GRUB_SIGNING_KEY} --detach-sign ${grub_cfg} >&2
    echo >&2
fi
###########
c) add another exception for *.sig in the function 'grub_file_is_not_garbage' in grub-mkconfig_lib

What are your comments?

Thank you,
Felix