Hacker GitHub

← All repos

Foxboron/sbctl

View on GitHub ↗ ★ 2,282 Go

:computer: :lock: :key: Secure Boot key manager

24 mentions on Hacker News by 11 people: 5 stories, 19 comments · first 2020-05-15 · latest 2026-05-12

Mentions per year 24 mentions · busiest year 2023 (5)
20082026
AllStoriesComments NewestTopOldest
  1. …much as possible, but so far this has not happened yet. Probably integrating something like sbctl ( https://github.com/Foxboron/sbctl#sbctl---secure-boot-manage... ) would do the trick, it's making the whole signing and key management…
    comment by embedding-shape · 2026-05-12 · in Lanzaboote – NixOS Secure Boot
  2. …to remove them, whether it will boot after is a different question (see option-ROM [1]) [1]: https://github.com/Foxboron/sbctl/wiki/FAQ#option-rom
    comment by NekkoDroid · 2026-02-08 · in Exploiting signed bootloaders to circumvent UEFI Secure Boot (2019)
  3. …support not loading those (whether needed or not) you will not be able to sometimes even POST. https://github.com/Foxboron/sbctl/wiki/FAQ#option-rom
    comment by NekkoDroid · 2026-02-08 · in Exploiting signed bootloaders to circumvent UEFI Secure Boot (2019)
  4. It's possible and it's what you should be doing. "sbctl" ( https://github.com/Foxboron/sbctl ) AFAIK has a reasonable frontend for doing that on Linux (don't know, I did it manually). You have to put the system in "secure boot setup mode"…
    comment by eqvinox · 2025-07-18 · in Linux and Secure Boot certificate expiration
  5. …since sbctl [0] was released with 0 issues. Granted, I don't use any Nvidia hardware. [0] https://github.com/Foxboron/sbctl
    comment by icar · 2025-07-18 · in Linux and Secure Boot certificate expiration
  6. …take care of enrolling and managing the keys. Are you immibis from libera.chat by any chance? [0] - https://github.com/Foxboron/sbctl
    comment by udev4096 · 2025-04-03 · in InitWare, a portable systemd fork running on BSDs and Linux
  7. …by the distro for secureboot usage. Maybe this should be part of the archlinux-keyring package? [1] https://github.com/foxboron/sbctl
    comment by cookiengineer · 2024-11-29 · in Bootkitty: Analyzing the first UEFI bootkit for Linux
  8. …only [...] kernels I signed" part. And just removing the pre-shipped keys can cause other problems: https://github.com/Foxboron/sbctl/wiki/FAQ#option-rom
    comment by NekkoDroid · 2024-07-25 · in Secure Boot is broken on 200 models from 5 big device makers
  9. …work with the compromised & the new root-of-trust, which at least opens some window of possibility. https://github.com/Foxboron/sbctl/blob/master/docs/sbctl.8.t...
    comment by jauntywundrkind · 2024-07-25 · in Secure Boot is broken on 200 models from 5 big device makers
  10. …Incidentally I've invested quite a bit of time in making user-friendly Secure Boot tooling as well. https://github.com/Foxboron/sbctl
    comment by Foxboron · 2023-07-30 · in Show HN: ssh-tpm-agent – SSH agent for TPMs
  11. …or baked in the firmware itself. If you're using a TPM for Secure Boot, you can use the commands in https://github.com/Foxboron/sbctl/wiki/FAQ#option-rom to know for sure.
    comment by Arnavion · 2023-05-06 · in Intel OEM Private Key Leak: A Blow to UEFI Secure Boot Security
  12. …partition. If you have secured your swap, you can patch [1] the kernel to allow hibernation. [0] https://github.com/Foxboron/sbctl [1] https://gist.github.com/kelvie/917d456cb572325aae8e3bd94a9c1...
    comment by Operative0198 · 2023-03-10 · in Arch Linux Btrfs with hibernation in a swapfile
  13. …user-friendly tooling to manage keys and sign stuff. Not that actually implementing this is hard. https://github.com/Foxboron/sbctl
    comment by Foxboron · 2023-01-17 · in MSI's (in)Secure Boot
  14. I wrote sbctl to try and make sure self-enrolling keys is completely painless https://github.com/Foxboron/sbctl
    comment by Foxboron · 2022-04-23 · in Fedora considers deprecating legacy BIOS
  15. …provisioning is a mess and hard to use, but that can be possibly made easy by projects like: https://github.com/Foxboron/sbctl I don't believe the UEFI interface is beneficial for data-center or embedded devices. The UEFI BDS interface was…
    comment by zaolin · 2022-04-21 · in Fedora considers deprecating legacy BIOS
  16. …to test this with, and I haven't gotten around to setting up a QEMU vm to test out this theory. https://github.com/Foxboron/sbctl/issues/85#issuecomment-886...
    comment by Foxboron · 2021-09-23 · in Authenticated Boot and Disk Encryption on Linux
  17. …from scratch and sbctl. I have even started writing full integration testing with tianocore/ovmf! https://github.com/Foxboron/sbctl It should hopefully end up being an improvement on efitools and sbsigntools. Tried posting about this on HN…
    comment by Foxboron · 2021-06-02 · in Producing a trustworthy x86-based Linux appliance
  18. …system. It works fine and I use it day-to-day these days, but it lacks several nice UX features. https://github.com/Foxboron/sbctl The second thing I did was reimplement the UEFI API portion in native Go code from scratch. It currently is…
    comment by Foxboron · 2020-09-24 · in NSA Technical Report on UEFI Secure Boot Customization [pdf]
  19. …but this feels awkward and I'd enjoy some better integration without having to call out to C-code. https://github.com/Foxboron/sbctl
    comment by Foxboron · 2020-05-15 · in Ask HN: What's your quarantine side project?