.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
.TH VIRT-FW-SIGDB "1" "September 2026" "virt-fw-sigdb 26.9" "User Commands"
.SH NAME
virt-fw-sigdb \- manual page for virt-fw-sigdb 26.9
.SH DESCRIPTION

The virt-fw-sigdb utility can create, modify and print EFI signature
databases.  This is the format used by UEFI firmware to store lists of
certificates and authenticode hashes for binaries in EFI variables
like 'PK', 'KEK', 'db' and 'dbx'.

Usually signature databases are embedded in EFI variable stores, so
for most use cases you'll probably should check out the
virt-fw-vars(1) utility instead of this.

The exception to this rule is the list of root CA certificates for TLS
connections which can be passed from the host via qemu to OVMF using
the etc/edk2/https/cacerts fw_cfg file.
.PP
usage: virt\-fw\-sigdb [\-h] [\-i FILE] [\-o FILE] [\-\-add\-cert GUID FILE]
.IP
[\-\-add\-hash GUID HASH] [\-x] [\-p]
.SS "options:"
.TP
\fB\-h\fR, \fB\-\-help\fR
show this help message and exit
.TP
\fB\-i\fR, \fB\-\-input\fR FILE
read efi sigdb FILE
.TP
\fB\-o\fR, \fB\-\-output\fR FILE
write efi sigdb FILE.
.TP
\fB\-\-add\-cert\fR GUID FILE
add x509 cert to sigdb, loaded in pem format from FILE
and with owner GUID, can be specified multiple times
.TP
\fB\-\-add\-hash\fR GUID HASH
add sha256 hash to sigdb, with owner GUID, can be
specified multiple times
.TP
\fB\-x\fR, \fB\-\-extract\fR
extract certificates
.TP
\fB\-p\fR, \fB\-\-print\fR
print sigdb
.SH EXAMPLES

.TP
Print system root CA database
virt-fw-sigdb --print \\
    --input /etc/pki/ca-trust/extracted/edk2/cacerts.bin
.SH AUTHOR

Gerd Hoffmann <kraxel@redhat.com>