FOG 1.6.0.127 — efitools unavailable on Oracle Linux 8 and Secure Boot signing failures

[sgennadi]

FOG 1.6.0.127 — efitools unavailable on Oracle Linux 8 and Secure Boot signing failures

FOG version: 1.6.0.127 (dev-branch)
Operating system: Oracle Linux 8 x86_64
Component: Installer / Secure Boot

Hello FOG developers,

I encountered several Secure Boot installation issues while upgrading FOG on Oracle Linux 8.

1. efitools package unavailable

The installer initially reported:

Skipping package: efitools (Does not exist)
Building efitools (no package for this distro)...Failed
efitools 1.9.2 did not build
Publishing Secure Boot variable updates...Skipped

The Oracle Linux 8 CodeReady Builder repository was enabled, but dnf install efitools and dnf repoquery --available '*efitools*' returned no matching package.

Working workaround

I found the following EL8-compatible RPM:

efitools-1.9.2-9.el8.x86_64

Source: AlmaLinux 8.10 Devel repository.

https://almalinux.pkgs.org/8/almalinux-devel-x86_64/efitools-1.9.2-9.el8.x86_64.rpm.html

After manually installing this RPM, the next FOG installation completed the previously failing step:

Skipping package: efitools (Already Installed)
Checking package: efitools...OK
Publishing Secure Boot variable updates...Done

This confirms that FOG recognizes the manually installed package.

Suggested improvement

Could the installer improve its handling of efitools on Oracle Linux 8, including checking for an existing compatible installation and providing more useful diagnostics when building from source fails?

2. Remaining Secure Boot signing failures

Even after resolving the efitools issue, the installer continues to report:

Signing FOS kernels and Memtest86+ for Secure Boot...Failed
Signing rEFInd for Secure Boot...Failed
Signing iPXE binaries for Secure Boot...Failed

The installer also reports that no Secure Boot CA is available on the server.

The overall installation finishes with Setup complete, but the Secure Boot signing stages remain unsuccessful.

Questions

1. Are these signing failures expected when no Secure Boot CA has been configured?
2. Should the installer skip signing with a clear warning instead of reporting a generic failure?
3. Is there a recommended procedure for initializing Secure Boot signing on an existing Oracle Linux 8 installation?
4. Can the installer provide more specific diagnostics when kernel, rEFInd or iPXE signing fails?

The exact compiler and signing error output has not yet been analyzed, so I cannot confirm whether these failures share a common root cause.

Thank you for your work on FOG Project.

[sgennadi]

[SOLVED] FOG 1.6.0.127 — Fix Secure Boot Signing on Oracle Linux 8 (efitools + sbsigntools)

I encountered Secure Boot signing failures when installing/upgrading FOG 1.6.0.127 (dev-branch) on Oracle Linux 8 x86_64.

I was able to resolve the installer signing failures using compatible RPM packages from AlmaLinux 8 and Rocky Linux 8.

Below is the step-by-step solution, including the verified results.

Step 1 — Enable the Oracle Linux 8 CodeReady Builder repository

sudo dnf config-manager --set-enabled ol8_codeready_builder
sudo dnf makecache

This repository provides additional development dependencies.

Step 2 — Install efitools 1.9.2

The default Oracle Linux 8 repositories did not provide efitools.

The FOG installer originally reported:

Building efitools (no package for this distro)........Failed
Publishing Secure Boot variable updates..............Skipped

I used the compatible AlmaLinux 8.10 RPM:

Package: efitools-1.9.2-9.el8.x86_64

Package information:

https://almalinux.pkgs.org/8/almalinux-devel-x86_64/efitools-1.9.2-9.el8.x86_64.rpm.html

Download:

curl -fL -o efitools-1.9.2-9.el8.x86_64.rpm \
  https://ftp.ucsb.edu/almalinux/8.10/devel/x86_64/os/Packages/efitools-1.9.2-9.el8.x86_64.rpm

Verify the RPM’s provenance, signature and dependencies using the trusted AlmaLinux signing key before installing. Do not disable signature verification.

Install:

sudo dnf install ./efitools-1.9.2-9.el8.x86_64.rpm

Verify:

rpm -q efitools
command -v cert-to-efi-sig-list
command -v sign-efi-sig-list
command -v efi-readvar

Confirmed installed version:

efitools-1.9.2-9.el8.x86_64

After installation, the FOG installer recognized the package and successfully generated Secure Boot variable updates.

Step 3 — Resolve the incompatible sbsigntools version

Oracle Linux 8 / EPEL initially provided:

sbsigntools-0.9.2-1.el8.x86_64

This version does not support the --addcert option required by the current FOG Secure Boot signing implementation.

The installer repeatedly failed with:

sbsign: unrecognized option '--addcert'

This caused failures signing FOS kernels, Memtest86+, rEFInd and iPXE binaries.

Step 4 — Install compatible sbsigntools 0.9.5

I used the Rocky Linux 8 Core SIG RPM:

Package: sbsigntools-0.9.5-2.el8.core.x86_64

Download:

curl -fL -o sbsigntools-0.9.5-2.el8.core.x86_64.rpm \
  https://dl.rockylinux.org/pub/sig/8/core/x86_64/core-infra/Packages/s/sbsigntools-0.9.5-2.el8.core.x86_64.rpm

Verify the package signature and trust the appropriate Rocky Linux signing key through an independently verified source. Review the DNF transaction before installation.

Install:

sudo dnf install ./sbsigntools-0.9.5-2.el8.core.x86_64.rpm

Verify:

rpm -q sbsigntools
command -v sbsign
sbsign --help 2>&1 | grep -- '--addcert'

Confirmed result:

sbsigntools-0.9.5-2.el8.core.x86_64

/usr/bin/sbsign

--addcert <addcertfile> additional intermediate certificates in a file

The --addcert option is important because FOG uses it to include an intermediate signing certificate in the EFI signature.

Simply removing this argument from the FOG source would not be an equivalent fix.

Step 5 — Rerun the FOG installer

With both compatible packages installed:

cd /root/fogproject-dev-branch/bin
sudo ./installfog.sh -y

The installer updates services and configuration, so this should be performed during a maintenance window, without active imaging tasks.

Step 6 — Confirm successful signing

After upgrading both packages, the installer reported:

Signing FOS kernels and Memtest86+ for Secure Boot..........Done
Publishing Secure Boot variable updates.....................Done
Signing rEFInd for Secure Boot..............................Done
Signing iPXE binaries for Secure Boot.......................Done (18)
Setup complete

All previously failing signing stages completed successfully.

Step 7 — Verify the signed binaries

Check the installed package versions:

rpm -q efitools sbsigntools

Confirmed:

efitools-1.9.2-9.el8.x86_64
sbsigntools-0.9.5-2.el8.core.x86_64

Inspect EFI signatures:

sbverify --list /var/www/html/fog/service/ipxe/bzImage
sbverify --list /tftpboot/snponly.efi

Both commands identified signatures containing the FOG Project Secure Boot Signing certificate.

Note that sbverify --list confirms the presence of signatures, not firmware trust. A certificate-specific verification and a real Secure Boot client boot test are still required for complete end-to-end validation.

Recommendations for FOG developers

1. Check whether efitools is available in the distribution’s repositories before attempting a source build.
2. Document an appropriate EL8-compatible efitools package or provide a reliable source-build fallback.
3. Check whether sbsign supports --addcert before starting Secure Boot signing.
4. Report an explicit compatibility error when the installed sbsigntools version lacks the required option.
5. Document the minimum supported sbsigntools version for RHEL-compatible distributions.
6. Preserve the certificate-chain behavior when handling older signing tools.
7. Consider improving the installer’s final summary so that a completed installation does not obscure Secure Boot signing failures.

Final Result

Resolved at the installer/signing stage on Oracle Linux 8 with FOG 1.6.0.127.

The complete Secure Boot signing process now reports success, and the inspected binaries contain signatures.

Actual client boot testing with Secure Boot enabled remains pending.

I hope this helps other Oracle Linux 8, RHEL 8, AlmaLinux 8 and Rocky Linux 8 users encountering similar issues.

Thank you to the FOG Project developers!

[sgennadi]

FOG 1.6.0.127 — Secure Boot signing fails on Oracle Linux 8 due to unsupported sbsign --addcert

FOG version: 1.6.0.127 (dev-branch)
OS: Oracle Linux 8 x86_64
Installed sbsigntools: 0.9.2-1.el8
Component: Installer / Secure Boot signing

I have identified the specific reason for the Secure Boot signing failures on Oracle Linux 8.

The distribution provides sbsigntools-0.9.2-1.el8.x86_64 from EPEL.

This version does not support sbsign --addcert.

During the installation, FOG repeatedly reports:

sbsign: unrecognized option '--addcert'

As a result, three signing stages fail:

Signing FOS kernels and Memtest86+ for Secure Boot...Failed
Signing rEFInd for Secure Boot...Failed
Signing iPXE binaries for Secure Boot...Failed

I found that FOG uses --addcert in lib/common/functions.sh and packages/secureboot/fog-sign-kernel.

I understand that the option is used to embed the intermediate signing certificate, so simply removing it may break certificate-chain verification.

The installed Secure Boot key directory contains MOK, PK and KEK key/certificate files. However, I have not yet verified the complete signing-certificate chain.

Related efitools issue — resolved with workaround

Oracle Linux 8 repositories did not provide efitools.

I manually installed the compatible AlmaLinux 8 RPM:

efitools-1.9.2-9.el8.x86_64

After that, FOG successfully completed:

Checking package: efitools...OK
Publishing Secure Boot variable updates...Done

Suggested improvements

1. Detect sbsign --addcert support before attempting Secure Boot signing.
2. Report a clear compatibility error when the installed sbsigntools lacks the required functionality.
3. Document or provide a compatible signing-tool version for Oracle Linux 8.
4. Preserve the intended intermediate-certificate trust chain.
5. Improve the handling of distributions where efitools is not available through native repositories.

Could you clarify the minimum supported sbsigntools version and the recommended installation method for Oracle Linux 8?

Thank you.

[Tom Elliott]

@sgennadi We don’t have support for Oracle Linux so I’m unsure how we can help out here?

I’m attempting to look at the addcert issue, it does seem sbsign only has the addcert argument in 0.9.4 and higher, and we’re attempting to use it, so RHEL based 8.x likely causing the issue you’re seeing.

[sgennadi]

[SOLVED] FOG 1.6.0.127 — Fix Secure Boot Signing on Oracle Linux 8 (efitools + sbsigntools)

I encountered Secure Boot signing failures when installing/upgrading FOG 1.6.0.127 (dev-branch) on Oracle Linux 8 x86_64.

I was able to resolve the installer signing failures using compatible RPM packages from AlmaLinux 8 and Rocky Linux 8.

Below is the step-by-step solution, including the verified results.

Step 1 — Enable the Oracle Linux 8 CodeReady Builder repository

sudo dnf config-manager --set-enabled ol8_codeready_builder
sudo dnf makecache

This repository provides additional development dependencies.

Step 2 — Install efitools 1.9.2

The default Oracle Linux 8 repositories did not provide efitools.

The FOG installer originally reported:

Building efitools (no package for this distro)........Failed
Publishing Secure Boot variable updates..............Skipped

I used the compatible AlmaLinux 8.10 RPM:

Package: efitools-1.9.2-9.el8.x86_64

Package information:

https://almalinux.pkgs.org/8/almalinux-devel-x86_64/efitools-1.9.2-9.el8.x86_64.rpm.html

Download:

curl -fL -o efitools-1.9.2-9.el8.x86_64.rpm \
  https://ftp.ucsb.edu/almalinux/8.10/devel/x86_64/os/Packages/efitools-1.9.2-9.el8.x86_64.rpm

Verify the RPM’s provenance, signature and dependencies using the trusted AlmaLinux signing key before installing. Do not disable signature verification.

Install:

sudo dnf install ./efitools-1.9.2-9.el8.x86_64.rpm

Verify:

rpm -q efitools
command -v cert-to-efi-sig-list
command -v sign-efi-sig-list
command -v efi-readvar

Confirmed installed version:

efitools-1.9.2-9.el8.x86_64

After installation, the FOG installer recognized the package and successfully generated Secure Boot variable updates.

Step 3 — Resolve the incompatible sbsigntools version

Oracle Linux 8 / EPEL initially provided:

sbsigntools-0.9.2-1.el8.x86_64

This version does not support the --addcert option required by the current FOG Secure Boot signing implementation.

The installer repeatedly failed with:

sbsign: unrecognized option '--addcert'

This caused failures signing FOS kernels, Memtest86+, rEFInd and iPXE binaries.

Step 4 — Install compatible sbsigntools 0.9.5

I used the Rocky Linux 8 Core SIG RPM:

Package: sbsigntools-0.9.5-2.el8.core.x86_64

Download:

curl -fL -o sbsigntools-0.9.5-2.el8.core.x86_64.rpm \
  https://dl.rockylinux.org/pub/sig/8/core/x86_64/core-infra/Packages/s/sbsigntools-0.9.5-2.el8.core.x86_64.rpm

Verify the package signature and trust the appropriate Rocky Linux signing key through an independently verified source. Review the DNF transaction before installation.

Install:

sudo dnf install ./sbsigntools-0.9.5-2.el8.core.x86_64.rpm

Verify:

rpm -q sbsigntools
command -v sbsign
sbsign --help 2>&1 | grep -- '--addcert'

Confirmed result:

sbsigntools-0.9.5-2.el8.core.x86_64

/usr/bin/sbsign

--addcert <addcertfile> additional intermediate certificates in a file

The --addcert option is important because FOG uses it to include an intermediate signing certificate in the EFI signature.

Simply removing this argument from the FOG source would not be an equivalent fix.

Step 5 — Rerun the FOG installer

With both compatible packages installed:

cd /root/fogproject-dev-branch/bin
sudo ./installfog.sh -y

The installer updates services and configuration, so this should be performed during a maintenance window, without active imaging tasks.

Step 6 — Confirm successful signing

After upgrading both packages, the installer reported:

Signing FOS kernels and Memtest86+ for Secure Boot..........Done
Publishing Secure Boot variable updates.....................Done
Signing rEFInd for Secure Boot..............................Done
Signing iPXE binaries for Secure Boot.......................Done (18)
Setup complete

All previously failing signing stages completed successfully.

Step 7 — Verify the signed binaries

Check the installed package versions:

rpm -q efitools sbsigntools

Confirmed:

efitools-1.9.2-9.el8.x86_64
sbsigntools-0.9.5-2.el8.core.x86_64

Inspect EFI signatures:

sbverify --list /var/www/html/fog/service/ipxe/bzImage
sbverify --list /tftpboot/snponly.efi

Both commands identified signatures containing the FOG Project Secure Boot Signing certificate.

Note that sbverify --list confirms the presence of signatures, not firmware trust. A certificate-specific verification and a real Secure Boot client boot test are still required for complete end-to-end validation.

Recommendations for FOG developers

1. Check whether efitools is available in the distribution’s repositories before attempting a source build.
2. Document an appropriate EL8-compatible efitools package or provide a reliable source-build fallback.
3. Check whether sbsign supports --addcert before starting Secure Boot signing.
4. Report an explicit compatibility error when the installed sbsigntools version lacks the required option.
5. Document the minimum supported sbsigntools version for RHEL-compatible distributions.
6. Preserve the certificate-chain behavior when handling older signing tools.
7. Consider improving the installer’s final summary so that a completed installation does not obscure Secure Boot signing failures.

Final Result

Resolved at the installer/signing stage on Oracle Linux 8 with FOG 1.6.0.127.

The complete Secure Boot signing process now reports success, and the inspected binaries contain signatures.

Actual client boot testing with Secure Boot enabled remains pending.

I hope this helps other Oracle Linux 8, RHEL 8, AlmaLinux 8 and Rocky Linux 8 users encountering similar issues.

Thank you to the FOG Project developers!

[Tom Elliott]

@sgennadi Thanks for the write-up. It matches what I found. --addcert first appears in sbsigntools 0.9.4, so 0.9.4 is the minimum. EPEL 8 ships 0.9.2, so this affects every EL8 install, not only Oracle Linux. The Rocky Linux Core SIG package you used is a good way to get a newer version.

A dev-branch change (PR #2081) makes the installer test for --addcert before it signs. When the option is missing, the installer now names the required version instead of printing a bare “Failed”.