pesign: could not parse signature list in EFI binary

[rhboot]

pesign: could not parse signature list in EFI binary

[mikolasan]

@xuguozhen , Have you compiled the kernel as an UEFI image enabling CONFIG_EFI_STUB (so called The EFI Boot Stub)?

[flaming-toast]

Hi, I have also encountered this same error with pesign on arm64. It seems that pesign is not able to handle the gzip compressed version of the vmlinuz image on arm64. Kernel was indeed compiled with CONFIG_EFI_STUB=y.

# file vmlinuz
vmlinuz: gzip compressed data, was "Image", last modified: Wed Sep 15 13:47:17 2021, max compression, from Unix, original size 73983984
# /usr/bin/pesign -P -h -i vmlinuz
pesign: could not parse signature list in EFI binary
# mv vmlinuz vmlinuz.gz # placate gunzip from complaining about lack of .gz extension
# gunzip vmlinuz.gz
# file vmlinuz
vmlinuz: MS-DOS executable
# /usr/bin/pesign -P -h -i vmlinuz
vmlinuz 0821930c2b81956d7396bd8fac51eadb937a484a018f4654c386f267505aa525

If I'm reading arch/arm64/Makefile correctly, it appears the arm64 kernel Image is gzip compressed by default, and the resulting compressed Image.gz is installed as vmlinuz. The pesign command only works when the kernel is decompressed, and we get the "pesign: could not parse signature list in EFI binary" when we pass in the gzip compressed vmlinuz image. I do wonder why it has no problem with the x86 vmlinuz image though..

[frozencemetery]

#64 (comment) is correct about what's going on here.