Arch Linux

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 734

[SOLVED] Update secure boot dbx without fwupd

Is it possible?

I compared revocation list in my system's dbx with microsoft's lastest DBXUpdate.bin and see that latest DBXUpdate.bin contains more hashes: it includes all present in my dbx and some more. So I want to update dbx in my system.

dbxtool is outdated: it dumps DBXUpdate.bin content with no errors but fails to update EFI variable:

$ sudo dbxtool -a DBXUpdate-20260402.x64.bin -v
Getting next EFI_SIGNATURE_DATA
Getting next ESL buffer
Getting next EFI_SIGNATURE_DATA
Getting next EFI_SIGNATURE_LIST
dbxtool: EFI Signature List is malformed
dbxtool: list has 19527 bytes left, element is 1691 bytes

The repo is archived four years ago in favor of fwupd. However, I consider installing fwupd package as last resort because of weird dependencies and "sysusers" creation just to use fwupd-dbxtool. Yes, I'm grumbling about software bloatification again.
So are there alternatives I can try?

Last edited by dimich (Yesterday 07:51:29)

-thc

Member

Registered: 2017-03-15

Posts: 1,164

Re: [SOLVED] Update secure boot dbx without fwupd

If I had to do this I would use "KeyTool.efi" (efitools package) - started from the internal EFI shell of the EFI firmware after placing "KeyTool.efi" and the update files inside the EFI partition.

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 734

Re: [SOLVED] Update secure boot dbx without fwupd

If I had to do this I would use "KeyTool.efi" (efitools package) - started from the internal EFI shell of the EFI firmware after placing "KeyTool.efi" and the update files inside the EFI partition.

Unfortunately, KeyTool.efi and other EFI binaries no longer shipped.
Fortunately, it turned out that Dell's native "BIOS Setup" recognizes DBXUpdate.bin format and I updated dbx directly from there, even without resetting custom KEK and db certs.
Marking as "solved". However, it would be nice to know if there are alternatives for fwupd or simple ways to build standalone fwupd-dbxtool.