From fd737172f1068870fe1ededbe9b2ed4a86663acd Mon Sep 17 00:00:00 2001
From: Christian Breunig <christian@breunig.cc>
Date: Wed, 4 Sep 2024 21:37:11 +0200
Subject: T861: add UEFI Secure Boot support

This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux
Kernel and enforces module signing. This results in an additional security
layer where untrusted (unsigned) Kernel modules can no longer be loaded into
the live system.

NOTE: This commit will not work unless signing keys are present. Arbitrary
keys can be generated using instructions found in:

  data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md
---
 Makefile | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'Makefile')

diff --git a/Makefile b/Makefile
index 85510131..2ff776c0 100644
--- a/Makefile
+++ b/Makefile
@@ -38,6 +38,11 @@ testc: checkiso
 testraid: checkiso
 	scripts/check-qemu-install --debug --configd --raid build/live-image-amd64.hybrid.iso $(filter-out $@,$(MAKECMDGOALS))
 
+.PHONY: testsb
+.ONESHELL:
+testsb: checkiso
+	scripts/check-qemu-install --debug --uefi --sbtest build/live-image-amd64.hybrid.iso $(filter-out $@,$(MAKECMDGOALS))
+
 .PHONY: testtpm
 .ONESHELL:
 testtpm: checkiso
-- 
cgit v1.2.3