In any case, not for the average person.
Comment on Secure Boot is completely broken on 200+ models from 5 big device makers
cmnybo@discuss.tchncs.de 2 months agoTo use secure boot correctly, you need disable or delete the keys that come preinstalled and add your own keys. Then you have to sign the kernel and any drivers yourself. It is possible to automate the signing the kernel and kernel modules though. Just make sure the private key is kept secure. If someone else gets a hold of it, they can create code that your computer will trust.
ilinamorato@lemmy.world 2 months ago
jabjoe@feddit.uk 1 month ago
Your want to store a copy of the private key on the encrypted machine so it can automatically sign kernel updates.
NekkoDroid@programming.dev 2 months ago
The kernel modules usually are signed with a different key. That key is created at build time and its pubic key is discarded after the build (and after the modules have been signed) and the kernel uses the private key to validate the modules IIRC. That is how Archlinux enables can somewhat support Secure Boot without the user needing to sign every kernel module or firmware file (it is also the reason why all the kernel packages aren’t reproducable).