help with secure boot booting from live cd with own MOK key
Hi everybody,
I am in the process of automating (currently on a VM, but I want to use
it on
my new server) the configuration of a debian trixie with ZFS on root,
with FDE,
out of a debian livecd. I have it working, but there is a point I
definitively
want to improve: Because the ZFS modules are out of kernel, I need to
disable
secure boot when the process starts, keep the original kernel around,
then
reboot to the configured system, reenable secure boot, register the MOK
key and
then switch to my UKI and remove the old kernel.
I am thinking, instead, in doing the following: modify the ISO to have a
persistent partition, with the hope that I can add there my MOK key,
register
it and reboot, and then simplify my configuration process all the way
until the
last reboot.
I have tried producing such a remastered ISO, but I am getting an error
that
the image is not OK, and seems it might be related to the fact that I
add a
persistence partition (so secureboot stops it there).
Does anybody here have experience with this? Might you guys know if I
can
request the enroll of a MOK key from a debian livecd, and after a reboot
with
the same livecd in place the key will still be there? Are there any
tools
available to create such setup or I have to script my way through?
Thank you!
--
Felix
Reply to: