mokutil --import-hash kernel_hash

from shim.

@lcp Unfortunately, that requires the computer to be booted.
My situation: I'm trying to get a USB to boot on secure boot enabled devices with the Microsoft key. I have an encrypted boot partition, so MokManager won't be able to see it. My attempts at using keys and signatures result in the error "Bootloader has not verified loaded image. System is compromised." Both the bootloader (grub) and the Linux kernel are signed with the key enrolled. The bootloader always loads, but it appears that Linux doesn't. I verified that this is not the fault of encryption by testing it on a non encrypted system. I tried hashes, and they worked, but they require an updated version of the kernel in a place where MokManager can access it at all times (can't do this because it eliminates the purpose of an encrypted boot partition) because enrolled hashes or signatures don't transfer from computer to computer. So now, I have a hash in the EFI partition of the kernel, and I it would be great if I were able to use that or get keys to work.

Thank you, I know this is quite a specific situation.

from shim.

That sounds strange to me. For SUSE/openSUSE, we also put grub.efi in ESP and keep the kernel in the encrypted partition. Wonder why your signature couldn't be verified.

from shim.

@lcp Do you have any tips on how to solve this proiblem or a solution?

from shim.

Could you reproduce the issue with OVMF? It's easier to debug shim in a virtual machine. At least you can attach gdb to shim to get more information.

from shim.