Managing EFI Boot Loaders for Linux:Controlling Secure Boot

I recently acquired a Surface Pro 4 and it was instantly obvious what a great machine it is. Having a tablet for casual use, while still having the capabilities of a powerful computer that you can use with a normal keyboard and mouse is extremely convenient. One of the first things that I wondered when I got the Surface was: how well will this thing run Linux? I can accept having to use Windows when I’m casually using the machine as a tablet, but when I really want to get work done, I am most comfortable in Linux. There were some difficulties at the beginning of installation, but once I was able to get started, installing Linux on the Surface was as easy as installing it on a regular laptop.

Secure boot tooling is terrible, can we do better? Currently the most widely used tooling for secure boot is the Ubuntu sbsigntools and efitools. If you are currently using secure boot both of these packages are probably installed on your system. Both of them support the basics of generating signature lists and signing the EFI variables with certificates, but they still have differences which is a source of confusion. efitools has 3 different ways of generating signature lists: cert-to-efi-hash-list, cert-to-sig-list and hash-to-efi-sig-list. “Luckily” there are man pages you can read which assumes you have some familiarity with UEFI itself.