check-sb-signature - Man Page

check-sb-signature [-l|--loglevel] [--pk-enroll] [--default-kek] [--profile] [--cert] [--pe] [--kek] [--db] [--dbx] [-h|--help] [-V|--version]

pkcs7 signature checker for efi binaries and efi variable updates

-l,  --loglevel <LEVEL> [default: info]

set loglevel

-h,  --help

Print help (see a summary with '-h')

-V,  --version

Print version

--pk-enroll <OPT>

select 'PK' option

Possible values:

• mgmt: EFI_CERT_EXTERNAL_MANAGEMENT_GUID
• redhat: Red Hat Secure Boot (PK/KEK key 1)
• microsoft: Windows OEM Devices PK

--default-kek

use default 'KEK' certificates

--profile <NAME>

select 'db' profile

Possible values:

• none: no certificates
• win11: Windows CA certificates, 2011 + 2023
• win23: Windows CA certificate, 2023 only
• win+rom23: Windows CA + Option ROM certificates, 2023 only
• uefi11: UEFI CA certificates, 2011 + 2023
• uefi23: UEFI CA certificate, 2023
• uefi+rom23: UEFI CA + Option ROM certificates, 2023
• redhat: Red Hat UEFI CA certificate
• redhat+rom: Red Hat UEFI CA + Option ROM certificates
• all: Both Windows and UEFI CA certificates, 2011 + 2023

--cert <FILE>

load additional certificates

--pe <FILE>

pe/efi binary to inspect

--kek <FILE>

KEK variable update to inspect

--db <FILE>

db variable update to inspect

--dbx <FILE>

dbx variable update to inspect

v0.1.13

Gerd Hoffmann <kraxel@redhat.com>