I encountered Secure Boot signing failures when installing/upgrading FOG 1.6.0.127 (dev-branch) on Oracle Linux 8 x86_64.

I was able to resolve the installer signing failures using compatible RPM packages from AlmaLinux 8 and Rocky Linux 8.

Below is the step-by-step solution, including the verified results.

Step 1 — Enable the Oracle Linux 8 CodeReady Builder repository

sudo dnf config-manager --set-enabled ol8_codeready_builder
sudo dnf makecache

This repository provides additional development dependencies.

Step 2 — Install efitools 1.9.2

The default Oracle Linux 8 repositories did not provide efitools.

The FOG installer originally reported:

Building efitools (no package for this distro)........Failed
Publishing Secure Boot variable updates..............Skipped

I used the compatible AlmaLinux 8.10 RPM:

Package: efitools-1.9.2-9.el8.x86_64

Package information:

https://almalinux.pkgs.org/8/almalinux-devel-x86_64/efitools-1.9.2-9.el8.x86_64.rpm.html

Download:

curl -fL -o efitools-1.9.2-9.el8.x86_64.rpm \
  https://ftp.ucsb.edu/almalinux/8.10/devel/x86_64/os/Packages/efitools-1.9.2-9.el8.x86_64.rpm

Verify the RPM’s provenance, signature and dependencies using the trusted AlmaLinux signing key before installing. Do not disable signature verification.

Install:

sudo dnf install ./efitools-1.9.2-9.el8.x86_64.rpm

Verify:

rpm -q efitools
command -v cert-to-efi-sig-list
command -v sign-efi-sig-list
command -v efi-readvar

Confirmed installed version:

efitools-1.9.2-9.el8.x86_64

After installation, the FOG installer recognized the package and successfully generated Secure Boot variable updates.

Step 3 — Resolve the incompatible sbsigntools version

Oracle Linux 8 / EPEL initially provided:

sbsigntools-0.9.2-1.el8.x86_64

This version does not support the --addcert option required by the current FOG Secure Boot signing implementation.

The installer repeatedly failed with:

sbsign: unrecognized option '--addcert'

This caused failures signing FOS kernels, Memtest86+, rEFInd and iPXE binaries.

Step 4 — Install compatible sbsigntools 0.9.5

I used the Rocky Linux 8 Core SIG RPM:

Package: sbsigntools-0.9.5-2.el8.core.x86_64

Download:

curl -fL -o sbsigntools-0.9.5-2.el8.core.x86_64.rpm \
  https://dl.rockylinux.org/pub/sig/8/core/x86_64/core-infra/Packages/s/sbsigntools-0.9.5-2.el8.core.x86_64.rpm

Verify the package signature and trust the appropriate Rocky Linux signing key through an independently verified source. Review the DNF transaction before installation.

Install:

sudo dnf install ./sbsigntools-0.9.5-2.el8.core.x86_64.rpm

Verify:

rpm -q sbsigntools
command -v sbsign
sbsign --help 2>&1 | grep -- '--addcert'

Confirmed result:

sbsigntools-0.9.5-2.el8.core.x86_64

/usr/bin/sbsign

--addcert <addcertfile> additional intermediate certificates in a file

The --addcert option is important because FOG uses it to include an intermediate signing certificate in the EFI signature.

Simply removing this argument from the FOG source would not be an equivalent fix.

Step 5 — Rerun the FOG installer

With both compatible packages installed:

cd /root/fogproject-dev-branch/bin
sudo ./installfog.sh -y

The installer updates services and configuration, so this should be performed during a maintenance window, without active imaging tasks.

Step 6 — Confirm successful signing

After upgrading both packages, the installer reported:

Signing FOS kernels and Memtest86+ for Secure Boot..........Done
Publishing Secure Boot variable updates.....................Done
Signing rEFInd for Secure Boot..............................Done
Signing iPXE binaries for Secure Boot.......................Done (18)
Setup complete

All previously failing signing stages completed successfully.

Step 7 — Verify the signed binaries

Check the installed package versions:

rpm -q efitools sbsigntools

Confirmed:

efitools-1.9.2-9.el8.x86_64
sbsigntools-0.9.5-2.el8.core.x86_64

Inspect EFI signatures:

sbverify --list /var/www/html/fog/service/ipxe/bzImage
sbverify --list /tftpboot/snponly.efi

Both commands identified signatures containing the FOG Project Secure Boot Signing certificate.

Note that sbverify --list confirms the presence of signatures, not firmware trust. A certificate-specific verification and a real Secure Boot client boot test are still required for complete end-to-end validation.

Recommendations for FOG developers

1. Check whether efitools is available in the distribution’s repositories before attempting a source build.
2. Document an appropriate EL8-compatible efitools package or provide a reliable source-build fallback.
3. Check whether sbsign supports --addcert before starting Secure Boot signing.
4. Report an explicit compatibility error when the installed sbsigntools version lacks the required option.
5. Document the minimum supported sbsigntools version for RHEL-compatible distributions.
6. Preserve the certificate-chain behavior when handling older signing tools.
7. Consider improving the installer’s final summary so that a completed installation does not obscure Secure Boot signing failures.

Final Result

Resolved at the installer/signing stage on Oracle Linux 8 with FOG 1.6.0.127.

The complete Secure Boot signing process now reports success, and the inspected binaries contain signatures.

Actual client boot testing with Secure Boot enabled remains pending.

I hope this helps other Oracle Linux 8, RHEL 8, AlmaLinux 8 and Rocky Linux 8 users encountering similar issues.

Thank you to the FOG Project developers!

A dev-branch change (PR #2081) makes the installer test for --addcert before it signs. When the option is missing, the installer now names the required version instead of printing a bare “Failed”.

I encountered Secure Boot signing failures when installing/upgrading FOG 1.6.0.127 (dev-branch) on Oracle Linux 8 x86_64.

I was able to resolve the installer signing failures using compatible RPM packages from AlmaLinux 8 and Rocky Linux 8.

Below is the step-by-step solution, including the verified results.

Step 1 — Enable the Oracle Linux 8 CodeReady Builder repository

sudo dnf config-manager --set-enabled ol8_codeready_builder
sudo dnf makecache

This repository provides additional development dependencies.

Step 2 — Install efitools 1.9.2

The default Oracle Linux 8 repositories did not provide efitools.

The FOG installer originally reported:

Building efitools (no package for this distro)........Failed
Publishing Secure Boot variable updates..............Skipped

I used the compatible AlmaLinux 8.10 RPM:

Package: efitools-1.9.2-9.el8.x86_64

Package information:

https://almalinux.pkgs.org/8/almalinux-devel-x86_64/efitools-1.9.2-9.el8.x86_64.rpm.html

Download:

curl -fL -o efitools-1.9.2-9.el8.x86_64.rpm \
  https://ftp.ucsb.edu/almalinux/8.10/devel/x86_64/os/Packages/efitools-1.9.2-9.el8.x86_64.rpm

Verify the RPM’s provenance, signature and dependencies using the trusted AlmaLinux signing key before installing. Do not disable signature verification.

Install:

sudo dnf install ./efitools-1.9.2-9.el8.x86_64.rpm

Verify:

rpm -q efitools
command -v cert-to-efi-sig-list
command -v sign-efi-sig-list
command -v efi-readvar

Confirmed installed version:

efitools-1.9.2-9.el8.x86_64

After installation, the FOG installer recognized the package and successfully generated Secure Boot variable updates.

Step 3 — Resolve the incompatible sbsigntools version

Oracle Linux 8 / EPEL initially provided:

sbsigntools-0.9.2-1.el8.x86_64

This version does not support the --addcert option required by the current FOG Secure Boot signing implementation.

The installer repeatedly failed with:

sbsign: unrecognized option '--addcert'

This caused failures signing FOS kernels, Memtest86+, rEFInd and iPXE binaries.

Step 4 — Install compatible sbsigntools 0.9.5

I used the Rocky Linux 8 Core SIG RPM:

Package: sbsigntools-0.9.5-2.el8.core.x86_64

Download:

curl -fL -o sbsigntools-0.9.5-2.el8.core.x86_64.rpm \
  https://dl.rockylinux.org/pub/sig/8/core/x86_64/core-infra/Packages/s/sbsigntools-0.9.5-2.el8.core.x86_64.rpm

Verify the package signature and trust the appropriate Rocky Linux signing key through an independently verified source. Review the DNF transaction before installation.

Install:

sudo dnf install ./sbsigntools-0.9.5-2.el8.core.x86_64.rpm

Verify:

rpm -q sbsigntools
command -v sbsign
sbsign --help 2>&1 | grep -- '--addcert'

Confirmed result:

sbsigntools-0.9.5-2.el8.core.x86_64

/usr/bin/sbsign

--addcert <addcertfile> additional intermediate certificates in a file

The --addcert option is important because FOG uses it to include an intermediate signing certificate in the EFI signature.

Simply removing this argument from the FOG source would not be an equivalent fix.

Step 5 — Rerun the FOG installer

With both compatible packages installed:

cd /root/fogproject-dev-branch/bin
sudo ./installfog.sh -y

The installer updates services and configuration, so this should be performed during a maintenance window, without active imaging tasks.

Step 6 — Confirm successful signing

After upgrading both packages, the installer reported:

Signing FOS kernels and Memtest86+ for Secure Boot..........Done
Publishing Secure Boot variable updates.....................Done
Signing rEFInd for Secure Boot..............................Done
Signing iPXE binaries for Secure Boot.......................Done (18)
Setup complete

All previously failing signing stages completed successfully.

Step 7 — Verify the signed binaries

Check the installed package versions:

rpm -q efitools sbsigntools

Confirmed:

efitools-1.9.2-9.el8.x86_64
sbsigntools-0.9.5-2.el8.core.x86_64

Inspect EFI signatures:

sbverify --list /var/www/html/fog/service/ipxe/bzImage
sbverify --list /tftpboot/snponly.efi

Both commands identified signatures containing the FOG Project Secure Boot Signing certificate.

Note that sbverify --list confirms the presence of signatures, not firmware trust. A certificate-specific verification and a real Secure Boot client boot test are still required for complete end-to-end validation.

Recommendations for FOG developers

1. Check whether efitools is available in the distribution’s repositories before attempting a source build.
2. Document an appropriate EL8-compatible efitools package or provide a reliable source-build fallback.
3. Check whether sbsign supports --addcert before starting Secure Boot signing.
4. Report an explicit compatibility error when the installed sbsigntools version lacks the required option.
5. Document the minimum supported sbsigntools version for RHEL-compatible distributions.
6. Preserve the certificate-chain behavior when handling older signing tools.
7. Consider improving the installer’s final summary so that a completed installation does not obscure Secure Boot signing failures.

Final Result

Resolved at the installer/signing stage on Oracle Linux 8 with FOG 1.6.0.127.

The complete Secure Boot signing process now reports success, and the inspected binaries contain signatures.

Actual client boot testing with Secure Boot enabled remains pending.

I hope this helps other Oracle Linux 8, RHEL 8, AlmaLinux 8 and Rocky Linux 8 users encountering similar issues.

Thank you to the FOG Project developers!

I’m attempting to look at the addcert issue, it does seem sbsign only has the addcert argument in 0.9.4 and higher, and we’re attempting to use it, so RHEL based 8.x likely causing the issue you’re seeing.

FOG version: 1.6.0.127 (dev-branch)
OS: Oracle Linux 8 x86_64
Installed sbsigntools: 0.9.2-1.el8
Component: Installer / Secure Boot signing

I have identified the specific reason for the Secure Boot signing failures on Oracle Linux 8.

The distribution provides sbsigntools-0.9.2-1.el8.x86_64 from EPEL.

This version does not support sbsign --addcert.

During the installation, FOG repeatedly reports:

sbsign: unrecognized option '--addcert'

As a result, three signing stages fail:

Signing FOS kernels and Memtest86+ for Secure Boot...Failed
Signing rEFInd for Secure Boot...Failed
Signing iPXE binaries for Secure Boot...Failed

I found that FOG uses --addcert in lib/common/functions.sh and packages/secureboot/fog-sign-kernel.

I understand that the option is used to embed the intermediate signing certificate, so simply removing it may break certificate-chain verification.

The installed Secure Boot key directory contains MOK, PK and KEK key/certificate files. However, I have not yet verified the complete signing-certificate chain.

Related efitools issue — resolved with workaround

Oracle Linux 8 repositories did not provide efitools.

I manually installed the compatible AlmaLinux 8 RPM:

efitools-1.9.2-9.el8.x86_64

After that, FOG successfully completed:

Checking package: efitools...OK
Publishing Secure Boot variable updates...Done

Suggested improvements

1. Detect sbsign --addcert support before attempting Secure Boot signing.
2. Report a clear compatibility error when the installed sbsigntools lacks the required functionality.
3. Document or provide a compatible signing-tool version for Oracle Linux 8.
4. Preserve the intended intermediate-certificate trust chain.
5. Improve the handling of distributions where efitools is not available through native repositories.

Could you clarify the minimum supported sbsigntools version and the recommended installation method for Oracle Linux 8?

Thank you.