sbsign
and pesign
can only sign PE format binaries - the format that UEFI and Windows use. If you want to sign something that isn't a PE binary, then you need a different tool.
If you want to sign a kernel module, you can use an appended signature - sign-file
and kmodsign
can do that. (But the DKMS system can do it all for you much more easily!)
If you want to sign your own kernel, you have a few options:
- build your kernel as an EFI binary and use
sbsign
or pesign
. There are kernel config options for this.
- use some other mechanism to secure the step from Grub to the kernel, like Grub's detached signature support. Note that this will require you to build your own grub and sign it in a way that the shim (or your UEFI firmware) accepts.