secure-boot

name	secure-boot
description	Enroll the Bluefin Secure Boot key to enable signed kernel modules (NVIDIA, custom kmods).
domain	sysadmin

Secure Boot Key Enrollment

Bluefin supports Secure Boot. For out-of-tree kernel modules (NVIDIA drivers, VirtualBox, custom kmods), the Bluefin signing key must be enrolled in the MOK (Machine Owner Key) database. This is a one-time post-install step required on NVIDIA variants and any system using custom kmods.

Load with: point your agent at this file.

When to Use

• First boot after installing a Bluefin NVIDIA variant
• After rebasing to an image with custom kernel modules
• When the system refuses to load a kmod due to Secure Boot signature verification failure
• Verifying whether the Bluefin key is already enrolled

When NOT to Use

• Disabling Secure Boot entirely — enrolling the key is better than disabling Secure Boot
• Systems where Secure Boot is already working and kmods load correctly

Check Secure Boot Status

# Is Secure Boot enabled in firmware?
mokutil --sb-state
# Output: "SecureBoot enabled" or "SecureBoot disabled"

# List currently enrolled MOK keys
mokutil --list-enrolled

Bluefin Enrollment Flow (Recommended)

Use the ujust recipe — it handles key location and enrollment automatically:

# Enroll the Bluefin Secure Boot key
ujust enroll-secure-boot-key

When prompted for a password during the MOK enrollment UI at reboot, enter:

universalblue

After running this command:

1. Reboot the system — systemctl reboot
2. At the blue MOK Manager screen, select Enroll MOK
3. Select Continue → Yes → enter the password universalblue
4. Select Reboot

The system will boot normally with the key enrolled. Kernel modules will now load.

If You Are Not Prompted at Reboot

This can happen if the MOK enrollment was not queued properly:

# Re-run the enrollment recipe
ujust enroll-secure-boot-key

# Or manually import the key (if you have the .der file)
sudo mokutil --import /path/to/public_key.der
# Set a temporary enrollment password when prompted — you'll enter it at reboot

The Bluefin public key is typically located at /etc/pki/akmods/certs/akmods-ublue.der or can be retrieved from the image. Use ujust --show enroll-secure-boot-key to see the exact path used on your image.

Manual Key Enrollment

If the ujust recipe is unavailable:

# Find the public key in the image
find /etc/pki /usr/share -name "*.der" 2>/dev/null | grep -i ublue

# Import the key
sudo mokutil --import /path/to/public_key.der
# Enter and confirm a temporary enrollment password

# Reboot and complete enrollment at the MOK Manager screen
systemctl reboot

Verify Enrollment Succeeded

After reboot:

# Check enrolled keys — look for "Universal Blue" or "ublue" in the output
mokutil --list-enrolled

# For NVIDIA: verify the driver module loaded
nvidia-smi   # should return GPU info, not an error

When This Is Required

Scenario	Action
NVIDIA variant (any)	Enroll key on first boot
Rebased to NVIDIA image	Enroll key after rebase + reboot
Custom kmod fails to load	Enroll key, then re-trigger kmod build
Secure Boot disabled for kmods	Enroll key instead of disabling Secure Boot