Create UEFI secureboot USB: Difference between revisions
No edit summary |
|||
| Line 33: | Line 33: | ||
openssl req -new -x509 -newkey rsa:2048 -keyout "$USER"_local.key -out "$USER"_local.crt -nodes -days 3650 -subj "/CN{{=}}$USER/" | openssl req -new -x509 -newkey rsa:2048 -keyout "$USER"_local.key -out "$USER"_local.crt -nodes -days 3650 -subj "/CN{{=}}$USER/" | ||
openssl x509 -in "$USER"_local.crt -out "$USER"_local.cer -outform DER}} | openssl x509 -in "$USER"_local.crt -out "$USER"_local.cer -outform DER}} | ||
== Install gummiboot == | |||
Install {{Pkg|gummiboot}} | |||
{{Cmd | apk add gummiboot }} | |||
{{Cmd | gummiboot install --path{{=}}/mnt --no-variables}} | |||
== Copy signed shim == | == Copy signed shim == | ||
| Line 41: | Line 46: | ||
wget -qO- http://www.codon.org.uk/~mjg59/shim-signed/shim-signed-0.2.tgz | tar xvz --strip-components{{=}}1 --no-same-owner}} | wget -qO- http://www.codon.org.uk/~mjg59/shim-signed/shim-signed-0.2.tgz | tar xvz --strip-components{{=}}1 --no-same-owner}} | ||
== Install | == Install Shim == | ||
== Unmount the partition == | == Unmount the partition == | ||
Revision as of 14:34, 30 December 2018
This article explains how to create an UEFI boot USB with parted and gummiboot.
In this example we will use /dev/sdX. This will be different depending on your system.
Create GPT boot partition
Install parted
apk add parted
Create a single UEFI boot partitions.
parted --script /dev/sdX mklabel gpt parted --script --align=optimal /dev/sdX mkpart ESP fat32 1MiB 100% parted --script /dev/sdX set 1 boot on
Create fat32 filesystem
Create a fat32 system with the name `Alpine`.
mkfs.vfat -n ALPINE /dev/sdX1
Copy content of ISO image to filesystem
It is possible to mount the iso image and copy files with cp or rsync and it is also possible to use 7z to extract content from the iso. In this example I will use the uniso utility from alpine-conf package.
mount -t vfat /dev/sdX1 /mnt cd /mnt uniso < /path/to/alpine-3.8.2-x86_64.iso
Create MOK Key
cd $HOME openssl req -new -x509 -newkey rsa:2048 -keyout "$USER"_local.key -out "$USER"_local.crt -nodes -days 3650 -subj "/CN=$USER/" openssl x509 -in "$USER"_local.crt -out "$USER"_local.cer -outform DER
Install gummiboot
Install gummiboot
apk add gummiboot
gummiboot install --path=/mnt --no-variables
Copy signed shim
Download Matthew J. Garrett's signed shim from http://www.codon.org.uk/~mjg59/shim-signed/shim-signed-0.2.tgz Extract it and copy MokManager.efi and shim.efi to /mnt/efi/boot
cd /mnt/efi/boot wget -qO- http://www.codon.org.uk/~mjg59/shim-signed/shim-signed-0.2.tgz | tar xvz --strip-components=1 --no-same-owner
Install Shim
Unmount the partition
Finally umount the disk
cd ~ && umount /mnt