https://wiki.debian.org/SecureBoot The Debian wiki page about SecureBoot has the following instructions: # mkdir -p /var/lib/shim-signed/mok/ # cd /var/lib/shim-signed/mok/ # openssl req -nodes -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -days 36500 -subj "/CN=My Name/" # openssl x509 -inform der -in MOK.der -out MOK.pem $ sudo mokutil --import /var/lib/dkms/mok.pub # prompts for one-time password $ sudo mokutil --list-new # recheck your key will be prompted on next boot I think that this should be done on installation by this package. The mokutil command can't be used for it's actual things until this is done so there's not much point in having it installed without this being done. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989463 The above bug report has a lot of information on this. The below copied from the above bug report has information on what Ubuntu is doing. https://git.launchpad.net/~ubuntu-core-dev/shim/+git/shim-signed/tree/openssl.cnf https://git.launchpad.net/~ubuntu-core-dev/shim/+git/shim-signed/tree/update-secureboot-policy This ubuntu update-secureboot-policy has a --new-key flag to generate the MOK in /var/lib/shim-signed/mok/. https://git.launchpad.net/~ubuntu-core-dev/shim/+git/shim-signed/tree/debian/shim-signed.postinst calls update-secureboot-policy --new-key on configure. It also sign the dkms modules.
Control: tag -1 wontfix
Control: severity -1 wishlist
system, e.g.:
lump:~$ mokutil --db | head -10
[key 1]
SHA1 Fingerprint: 46:de:f6:3b:5c:e6:1c:f8:ba:0d:e2:e6:63:9c:10:19:d0:ed:14:f3
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
61:08:d3:c4:00:00:00:00:00:04
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation Third Party Marketplace Root
Validity
lump:~$ mokutil --sb-state
SecureBoot disabled
Not everybody is using the package to enrol keys...
I just realised how grumpy that might sound... :-) A patch to add a script to do the key generation for users, and (maybe?) a debconf question to ask them if they'd like it to be run would be nice, though!
Dear developers, This patch adds a debconf question to configure a MOK (defaults to false; also translated to French), and maintainer scripts to generate a MOK, request its enrollment (one-time password: machine's hostname), and generate conffiles for DKMS and systemd-ukify (managed by ucf). Please let me know if it suits your needs. Sorry to contribute this so late in Trixie's release cycle, I hope it can get in in time (I know it's not a "small, targeted fix", but it's also a feature that was requested for a long time; if it can't, well, we'll wait for Forky!). Regards,
Isn't dkms already doing this key import for the user? And why do you think a question most users can't answer is suitable to show to everyone? Too late and the maintainers already said they don't want this package to do it. Bastian
Le 21/05/2025 à 20:41, Bastian Blank a écrit : No, DKMS doesn't import the key into the shim (I didn't find any trace of this action into the code). It does generate a key, but in its own path (/var/lib/dkms), which is not the standard path stated in the Debian Wiki. Also, it names the certificate in DER format "mok.pub", which is confusing for users (sbsign needs it in PEM format). Having the certificate in both formats, with extensions clearly indicating the format, is a benefit for the users. For the debconf question, its priority is set to high, why would users not see it ? Which maintainers ? Steve McIntyre said in this very bug report 8 months ago : Also, do you have to be so bitter in your answer ? Is that your way to welcome contributions that were specifically suggested by package maintainers ?