#1032375 memtest86+: fails to work with Secure Boot enabled

Package:
memtest86+
Source:
memtest86+
Description:
thorough real-mode memory tester
Submitter:
Russell Coker
Date:
2025-07-18 23:03:01 UTC
Severity:
normal
#1032375#5
Date:
2023-03-05 12:20:10 UTC
From:
To:
If you select the EFI version of memtest86+ from GRUB when Secure Boot is
enabled then it gives the message "error: bad shim signature" and fails back
to GRUB.

Please provide a signed version so Secure Boot doesn't have to be disabled to
run it.
#1032375#10
Date:
2023-03-05 15:09:45 UTC
From:
To:
Am Sonntag, dem 05.03.2023 um 23:20 +1100 schrieb Russell Coker:

Hi,

this has been already talked on IRC in #debian-efi.
First step is to get the ok from the shim-review process.
I created already an issue here:

https://github.com/rhboot/shim-review/issues/314
#1032375#17
Date:
2025-07-18 23:00:12 UTC
From:
To:
Dear Maintainer,

I have a workaround solution meanwhile.
Create your own keys which will later be used with `mokutil` with the following script I have created for this scenario: https://codeberg.org/horsey_guy/MOK_Key_Create/raw/branch/main/create_keys.sh

You can now use `sbsign --key {SOME_NAME}.key --cert {SOME_NAME}.crt /boot/memtest86+x64.efi --output /boot/memtest86+x64.efi.signed` (cannot in-place sign)
Then symlink /boot/memtest86+x64.efi to /boot/memtest86+x64.efi.signed with `ln -sf /boot/memtestx86+64.efi.signed /boot/memtestx86+64.efi`.
The ia32 variants can be signed too.

Be sure to do the signing whenever memtest86+ is updated. You can make some sort of post-installation hook if that's possible to automate this.

Now use mokutil or else the keys will be rejected: `mokutil --import path/to/cert.der`

I have not tested this method although I will, but it should work as I have done some variation of this.

It would be nice if memtest86+ could be signed with Debian's keys though.

Sincerely,
Huey Chen