Option to keep Windows keys?

[developer91234]

I know it's not the most secure approach but given the big fat warning here it might be necessary under some circumstances and desirable under others (like if you don't want to disable secure boot every time you want to load up windows).

[maximbaz]

I don't know how it would be possible to reuse the keys since we don't have access to private keys to sign our efi binaries, but in general the signing command happens in this line:

arch-secure-boot/arch-secure-boot

Line 112 in 2909c3d

sbsign --key "$KEYSDIR/db.key" --cert "$KEYSDIR/db.crt" /usr/lib/fwupd/efi/fwupdx64.efi

Don't run generate-keys and enroll-keys and update the line above to sign the efi files in a different way, and that should be it?

[developer91234]

sbctl enroll-keys -m should preserve the ms keys. I don't think any update to the code is necessary beyond that.

[maximbaz]

Okay! I don't think I'll add it directly to the script, since this tool provides a very opinionated setup, but since enroll is a one-time operation I'm happy to include it in README to guide people who want this.

Do I understand correctly that you still need to run arch-secure-boot generate-keys, but instead of arch-secure-boot enroll-keys you use sbctl enroll-keys -m, and that is it?

arch-secure-boot/arch-secure-boot

Lines 137 to 145 in 2909c3d

	enroll-keys)
	echo "Enrolling Secure Boot keys..."
	find "$SBKEYSDIR" -mindepth 2 | read || error "Error: keys are not generated yet."
	chattr -i /sys/firmware/efi/efivars/{PK,KEK,db}*
	sbkeysync --verbose
	efi-updatevar -f "$SBKEYSDIR/PK/PK.auth" PK
	;;

[developer91234]

I believe so, haven't tested. There are some more "comprehensive" solutions that require typing 50 lines of gibberish which I don't even want to think about.

[maximbaz]

Cool, done in 5ecb112, thanks!

[developer91234]

I meant replace sbkeysync --verbose with sbctl enroll-keys -m.

[maximbaz]

I think let's wait with refining the docs until someone actually tries this, according to sbctl manual, enroll-keys might do more, e.g. to replace EFI variables too (part of what arch-secure-boot enroll-keys does).