...
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Platform Key/" -keyout PK.key -out PK.crt -days 3650 -nodes -sha256
$ openssl x509 -in PK.crt -out PK.cer -outform DER
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Key Exchange Key/" -keyout KEK.key -out KEK.crt -days 3650 -nodes -sha256
$ openssl x509 -in KEK.crt -out KEK.cer -outform DER
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Database/" -keyout DB.key -out DB.crt -days 3650 -nodes -sha256
$ openssl x509 -in DB.crt -out DB.cer -outform DER
Choose an EFI application in your edk2 build aritfacts to do the test, or use this EmptyApplication-Riscv.efi
$ sbsign --key DB.key --cert DB.crt --output EmptyApplication-Riscv.efi.signed EmptyApplication-Riscv.efi
This will have Invalid Update the sbsigntool to the latest one if you encounter "invalid PE header magic" issue if use the default sbsign in ubuntu 22.04, need rebuild the sbsigntools, refer the Step 3 to solve this issue ! If no Invalid PE header magic then skip Step 3.in signing riscv64 binary
Step 3 (Optional): Download and rebuild the latest sbsigntools
$ git clone https://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git
$ cd sbsigntools/
$ vim src/coff/pe.h
Make sure the RISCV64 machine is there
#define IMAGE_FILE_MACHINE_RISCV64 0x5064
$ git clone https://github.com/rustyrussell/ccan.git lib/ccan.git
$ git submodule init
$ git submodule update
$ sudo apt-get install binutils-dev gnu-efi help2man
$ ./autogen.sh
$ ./configure
$ make
$ cd ../
$ ./sbsigntools/src/sbsign --key DB.key --cert DB.crt --output EmptyApplication-Riscv.efi.signed EmptyApplication-Riscv.efi
Step 4: Sign the EFI applicaiton by using private key, and copy the : Copy the public key to the fat disk
...
$ cp *.cer ~/src/fat/
Step 54: Enroll the PK, KEK, DB keys to the EDK2 as the Custom Secure Keys
Execute the run.sh script in EDK2_00_02_04 Evaluate with OpenSBI
Playing with Secure Boot in Tianocore
By default, TianoCore boots up into Setup Mode, meaning the platform is not provisioned with any keys and the user can take control. To take control, go to the EFI menu screens (type 'exit' command if you’re at the efi boot prompt) select the “Device Manager” entry, then “Secure Boot Configuration”. Here you will see the status of the Secure Boot flag (“Attempt Secure Boot”) and the platform mode. Setting the platform from “Standard Mode” to “Custom Mode” will allow you to edit the keys. Once the platform is in “Custom Mode”, a “Custom Secure Boot Options” menu will appear and you will be able to manipulate the four sets of key databases from here. The format of all key files for openssl generated keys is DER format (by default openssl generates PEM format). Note that the KEK, db and dbx options will ask you for a GUID as well as a key file. The GUID is the platform’s way of identifying the key. It serves no purpose other than for you to tell which key is which when you delete them (it’s not used at all in signature verification). By default, since GUIDs aren’t really human readable, I just ignore this and the GUID is set to all zeros.
...