Skip to content

KeyTool.efi and other EFI binaries no longer shipped — intentional?

Description:

Recently (with v1.9.2-6, specifically in this commit), the efitools package stopped including prebuilt EFI binaries, notably KeyTool.efi. That was a pretty important tool for manually managing Secure Boot keys, so I'm curious as to the reasoning here, especially since neither the commit nor the linked issue say anything about this change. The next commit (which bumps the pkgrel to 6) just says "do not build EFI payloads."

My best guess, based on this change in the same commit, is that the patch was intended to stop signing EFI binaries, rather than stop shipping them altogether? This could be very wrong, though, so I'd be interested to know whether this was actually intentional.

Additional info:

  • package version(s): 1.9.2-6
  • config and/or log files: N/A
  • link to upstream bug report, if any: N/A

Steps to reproduce:

Install efitools 1.9.2-6 and notice that EFI binaries are no longer included.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information