Dear Maintainer,

The systemd-boot-efi-amd64-signed package provides a signed systemd-boot EFI
binary, but it does not include the certificate used to sign it. I cannot find
any official source that provides this certificate, which seems rather odd.

I understand that this boot loader is intended to be run via the Microsoft-
signed shim. However, if a user controls their Secure Boot platform, shim is
unnecessary. It is simpler to use the systemd-boot binary directly.

It is inconvenient to manually sign the binary after every update, especially
since Debian already provides a signed version. Therefore, it seems reasonable
to add the Debian Secure Boot Signer certificate to the UEFI DB. However, the
certificate does not appear to be provided anywhere.

It could be even better to provide a Debian KEK certificate and use it to allow
automatic updates to the UEFI DB. But at the very least, please provide the DB
certificate in a reasonable and officially documented location.

src:shim has it, and also  https://dsa.debian.org/secure-boot-ca

On Sat, 5 Sep 2026 23:16:33 +0200 Chris Hofstaedtler <zeha@debian.org> wrote:
systemd-boot EFI
cannot find
rather odd.

Thanks! Its also possible to extract the certificate from the systemd-
boot EFI binary itself.

But that would be way more convenient, if it were provided in package
itself in a clear and obvious way. Maybe as a part of the docs, or
something like that.