boot/efi: Optionally sign our EFI bootloader

* The private keys are in possession of Haiku, Inc. Change-Id: I3b5b004e1dce0102f8a65f6d682f7e428845efe8 Reviewed-on: https://review.haiku-os.org/c/haiku/+/4936 Reviewed-by: Alex von Gluck IV <[email protected]> Reviewed-by: waddlesplash <[email protected]>
2022-02-18 21:32:56 +00:00
parent 9a7906eadb
commit 31f27c4d39
7 changed files with 121 additions and 1 deletions
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDEzCCAfugAwIBAgIUX+q+28/np8o/Vg64GrIN8CEcEA8wDQYJKoZIhvcNAQEL
+BQAwGTEXMBUGA1UEAwwOSGFpa3UsIEluYy4gREIwHhcNMjIwMjA2MTk1MTQzWhcN
+NDIwMjA2MTk1MTQzWjAZMRcwFQYDVQQDDA5IYWlrdSwgSW5jLiBEQjCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKn6b6J60zU5L+UPXhHbJ2epyoQ+YKAo
+6L7gmk79nBFOqidX10wfBFijZxdPvBeGHlMpmukjdgGNbOHKqYrYLsJHhrd/IZ+T
+TMSa+ZD2d+2dSgn+jYQji3mOVnrb2xemRo9+IDiC37cEVAmOO1t5E0NmyM2rm2p0
+HeShbLbcg+78mpgs3mDTzWbq4p7VRVdxjDI1i7108aaf2dVpDbh3Q0ipO9YEoTQq
+3cXUeQ4IiR7FFzPlEZHSViSi3Fieg4GTHjkhZG3HLHYGEuR/B8lA9+S4uvYCiV8n
+t/NVC6osnUBCKyl+00gLLohQGkNGDZXGZNwcIH9tls/AHysoNPrpI98CAwEAAaNT
+MFEwHQYDVR0OBBYEFNganI/FIKluRVA+9LbrNDAZSjJBMB8GA1UdIwQYMBaAFNga
+nI/FIKluRVA+9LbrNDAZSjJBMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBAAGz7qdUBHtk30JlB3M+z6Z78tIfz288SV+eekO+rl+8Fo+M+qSB6OrO
+j1VcUSEQgbLFqoJz9haoEyUxXP8g/XWNx5n9gbPWZQHwva1AN9PHw4modF1XDCAV
+N1F3pQ1atz3K+fOZWU6peDyoQEKI2szAtNycoV7x5SXFPybyyC4yPCW3ijou9sxW
+D8jPECU+6RTh93pFptL+/KPFcLOi5ihCyMApqjNSvOox6m0LFUxCSpBJIk0QBOPQ
+PHDAiSkkQaOHfA/5AnU/iyedsBYBlnY40drY4DGEntRG5yiMhvRjfmFfEufujCiZ
+OVrndpb+VY6W5EzvGusu3HeSaMywj8w=
+-----END CERTIFICATE-----
@@ -0,0 +1,37 @@
+# Haiku UEFI Keys
+
+The EFI keys in this directory can be used to boot Haiku in UEFI Secure Mode.
+The Haiku, Inc. key must be appended to your EFI BIOS trusted keychain to function.
+
+> This is only needed when you're booting in EFI Secure Boot mode! It's probably
+> easier to disable EFI Secure Boot in most cases.
+
+## Installing UEFI Keys
+
+To trust Haiku's EFI bootloader, you'll need to append our DB key to your BIOS's
+DB keychain.
+
+> Ensure the Haiku installation media is inserted / plugged into your computer.
+
+Real world examples:
+
+* Dell XPS 13 Laptop (Dell BIOS)
+  * Boot laptop, press F2 to enter BIOS
+  * Settings -> Secure Boot -> Secure Boot Enable
+    * Verify Secure Boot is enabled, otherwise this does nothing.
+  * Settings -> Secure Boot -> Expert Key Management
+    * "Enable Custom Mode" checked
+    * Press "Reset All Keys"
+    * Choose db, then press "Append from File"
+    * Navigate to the Haiku USB installation media
+    * EFI -> KEYS -> DB.auth
+
+* Framework Laptop (InsydeH20 BIOS)
+  * Boot laptop, press F2 to enter BIOS
+  * Security -> Secure Boot
+  * Enforce Secure Boot enabled
+  * DB Options -> Enroll Signature -> PKCS7
+  * Haiku ESP -> KEYS -> DB.cer
+  * (you can leave the "Owner_GUID" blank)
+  * Enroll DB.cer -> Yes
+  * F10, Save and Exit