Morten Linderud

When building and distributing packages and binaries you preferably don't want them to take up gigabytes of space on the disk. Stripping debug information from these distributed binaries are one way of saving a lot of space, but makes debugging crashing applications had. Debug packages collects the stripped information into separate packages which can be installed to provide the necessary information to debug crashing application.

Arch Linux implemented support for debug packages in 2022, and in this presentation we will take a look at the improvements that was made to the pacman package manager, the infrastructure changes that was needed and how debug packages are distributed through debuginfod.

Taking advantage of Secure Boot should be simple! But convoluted tooling and poor documentation makes this extremely hard for people to navigate viable options, opting them to disable Secure Boot unless they are using the shim provided by larger distributions. In this talk I'll introduce the tooling improvements I have made in this space. go-uefi which is a userspace library for dealing with efivarfs with high-level abstractions and support for the most common operations towards secure boot on Linux. Built on-top of this is the secure boot key manager, sbctl. This aims to be a user-friendly way of setting up and interacting with secure boot for the common user. We will take a look at why secure boot is hard to grasp for users, the current challenges facing the existing tools and how sbctl solves these. Lastly, we will introduce some solutions to deal with the largest hurdle that stands in the way of independent key management: Option ROM.

Utilizing secure boot should be simple. Our current tooling is badly integrated, abstractions leaking and the code bases are not reusable. Functionality is spread between several projects and not one covers all your needs. This amounts to a confusing landscape. sbctl and go-uefi is a tool, and a low-level UEFI library, that attempts to push the secure boot landscape forward.

In this talk I'll do a short introduction of secure boot and the tooling people normally use. We will look at the different use cases each of them provide and missing functionality. Then I'll do a short demonstration of sbctl and go-uefi.

The goal is to try provoke some ideas how we can make secure boot more accessible for users. Currently the tooling assumes some familiarity with secure boot implementation details (signature lists, PK/KEK/db keys and so on) and that shouldn't be needed to have a fairly basic secure boot setup.

Other people: Jakub Łęcki