Re: secure boot

["Philip McGrath" <philip@philipmcgrath.com>]

On Sun, Aug 21, 2022, at 4:46 AM, Josselin Poiret wrote:
> Hi Antonio,
>
> Antonio Carlos Padoan Junior <acpadoanjr@yahoo.com.br> writes:
>
>> As far as I understand, Guix doesn't provide means to automatically sign
>> bootloaders and kernels in order to use UEFI secure boot after each system
>> reconfigure (assuming a PKI is properly implemented).  Hence, using
>> secure boot with Guix is currently not viable (am i correct?).
>
> You're right, we don't really have any means to do that.  It would have
> to be done outside of the store, again, so that the private key doesn't
> leak into it.
>

I could imagine a process like this:

 1. Build the binary that needs to be signed.
 2. Outside of the Guix build environment, create a detached signature
    for the binary using your secret key.
 3. Add the detached signature to the Guix store, perhaps with 'local-file'.
 4. Use Guix to attach the signature to the built binary.
 5. Use the signed binary in your operating-system configuration.

IIUC, executables that run in the UEFI environment need "secure boot" signatures to be attached, but you may be able to use detached signatures directly for other things that they want to verify by means other than "secure boot".

I expect the things that need to be signed are small, build reproducibly, and change rarely, which might make this especially practical.

-Philip