Enabling UEFI Secure Boot Across Modern Build Systems

Explore the complex landscape of UEFI Secure Boot implementation across modern Linux build systems in this 30-minute conference talk from the Linux Plumbers Conference. Examine the fundamental tension between vendor control and user autonomy when Microsoft's keys serve as the primary root of trust in UEFI firmware, forcing Linux distributions to either obtain Microsoft signatures or remain unbootable on most commodity hardware. Understand how major distributions like Red Hat, Fedora, Ubuntu, Debian, and openSUSE have converged on using shim—a minimal first-stage bootloader signed by Microsoft that chains trust to distribution-specific keys—creating structural dependency on Microsoft's signing process. Compare this approach with self-signing alternatives used by distributions like Gentoo, Arch, and ParticleOS, where users generate and enroll their own keys directly in UEFI firmware. Discover the practical barriers that make self-signing viable primarily for power users, enterprise environments, and embedded systems, while remaining impractical for general user distributions. Learn about the ongoing challenges in key management, particularly the complex balance between securely storing private keys and making them accessible to automated CI/CD pipelines. Consider potential solutions through shared signing infrastructure that build systems could integrate with to reduce complexity while maintaining security, and explore existing efforts that could serve as foundations for a more cooperative approach to UEFI Secure Boot across the Linux ecosystem.