Repository :
http://git.fedorahosted.org/git/?p=docs/uefi-secure-boot-guide.git
On branch : master
---------------------------------------------------------------
commit f5c1b2f8541d59acf7e660d309dfdaf72db7d84b
Author: Eric Christensen <sparks(a)redhat.com>
Date: Thu Jan 31 14:53:55 2013 -0500
Added explaination of pesign
---------------------------------------------------------------
en-US/Tools.xml | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/en-US/Tools.xml b/en-US/Tools.xml
index 244652c..c9d6854 100644
--- a/en-US/Tools.xml
+++ b/en-US/Tools.xml
@@ -11,12 +11,13 @@
<section id="sect-UEFI_Secure_Boot_Guide-Tools-shim">
<title>Shim</title>
<para>
- Shim is the cryptographically signed software that creates the trust between the UEFI
firmware and GRUB and the kernel software. Shim is cryptographically signed by Verisign
(via Microsoft) so that the UEFI firmware will cryptographically recognize the
&PRODUCT; system and allow the software to continue through the boot process. The
shim validates GRUB and kernel though a cryptographic verification based on a
&PRODUCT; key used to sign all three.
+ <firstterm>Shim</firstterm> is the cryptographically signed software that
creates the trust between the UEFI firmware and GRUB and the kernel software. Shim is
cryptographically signed by Verisign (via Microsoft) so that the UEFI firmware will
cryptographically recognize the &PRODUCT; system and allow the software to continue
through the boot process. The shim validates GRUB and kernel though a cryptographic
verification based on a &PRODUCT; key used to sign all three.
</para>
</section>
<section id="sect-UEFI_Secure_Boot_Guide-Tools-pesign">
<title>pesign</title>
<para>
+ <firstterm>Pesign</firstterm> allows users to create their own shim and
use their own cryptographic keys. Using this tool, one can create their own trust model
and not be required to trust the Microsoft keys and trust model. Once the user has
created their keys and signed their shim, and optionally signed and built GRUB and kernel,
they can use the setup mode in the firmware to install &PRODUCT; and use the
<firstterm>sbsetup</firstterm> tool as provided by pesign to enroll their keys
in the firmware.
</para>
</section>
<section id="sect-UEFI_Secure_Boot_Guide-Tools-efikeygen">