Changes

su -

apt update

# Package efitools must to be compiled and installed manually because Debian repository contains old 1.4.2 version:

apt build-dep -y efitools

openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$CN db, O=$O/" -keyout db.key -out db.crt -days 7300 -nodes -sha256

* Convert open part of the keys to the ESL format understood for UEFI

UUID=$(uuidgen --random)

cert-to-efi-sig-list -g $UUID db.crt db.esl

* Sign ESL files

sign-efi-sig-list -k PK.key -c PK.crt PK PK.esl PK.auth

sign-efi-sig-list -k KEK.key -c KEK.crt db db.esl db.auth

* At this stage your are ready to sign GRUB EFI binary and add it to the list of binaries allowed by Secure Boot

* Create initial GRUB configuration script grub.init.cfg

GRUB_PASSWORD="Your GRUB password"

GRUB_PASSWORD_HASH=$(echo -e "$GRUB_PASSWORD\n$GRUB_PASSWORD" | grub-mkpasswd-pbkdf2 | grep -o "grub.*")

cat > grub.init.cfg << EOF

set check_signatures=enforce

reboot

EOF

### as result grub.init.cfg will be created

Subkey-Type: ELG-E

Subkey-Length: 1024

Expire-Date: 0

# Do a commit here, so that we can later print "done" :-)

%commit

%echo done

EOF

gpg --batch --gen-key gpg.batch.file 2>&1 | tee gpg.log

GPG_KEY=$(cat gpg.log | grep -o "gpg: key [0-9A-Z]* marked as ultimately trusted" | awk '{ print $3 }')

echo GPG_KEY=$GPG_KEY

gpg --export $GPG_KEY > gpg.key

* Sing grub.init.cfg with your GPG key

### as result grub.init.cfg.sig will be created

search search_fs_file search_fs_uuid search_label sleep tar terminal verify video_fb"

grub-mkstandalone -d /usr/lib/grub/x86_64-efi -O x86_64-efi --modules "$MODULES" --pubkey gpg.key --output grubx64.efi boot/grub/grub.cfg=grub.init.cfg boot/grub/grub.cfg.sig=grub.init.cfg.sig -v

### as result grubx64.efi will be created

* Sign grubx64.efi with your db key

sbsign --key db.key --cert db.crt grubx64.efi

### as result grubx64.efi.signed will be created, it will be your bootloader

== Prepare signed grub.cfg kernel and initrd on the EFI partition ==

* Create grub.cfg on the EFI partition

KERNEL_VERSION=$(uname -r)

}

EOF

### as result grub.cfg will be created, please review it

cp /boot/vmlinuz-$KERNEL_VERSION /boot/efi/

cp /boot/initrd.img-$KERNEL_VERSION /boot/efi/

* Sign grub.cfg, kernel and initrd with your GPG key

gpg --default-key "$GPG_KEY" --detach-sign /boot/efi/vmlinuz-$KERNEL_VERSION

gpg --default-key "$GPG_KEY" --detach-sign /boot/efi/initrd.img-$KERNEL_VERSION

### as result signatures of these files will be created

* Replace your existent bootloader with signed one

# place grubx64.efi.signed you've created before as default bootloader

* Install keys into EFI (PK last as it will enable Custom Mode locking out further unsigned changes):