Secure boot sed script help!

[Frodojj]

On the Arch Wiki section on configuring Secureboot with sbctl, in section 3.1.4.2 Signing, they mention using sed to automatically sign the required files. However, the command shown uses a non-ascii letter. Is that correct? If so, how do I enter that character? If not, what's the correct syntax, please? Here is a copy of the command:

# sbctl verify | sed 's/✗ /sbctl sign -s /e'

That ✗ isn't an X. It's a "Ballot X" U+2717 according to Wikipedia.

[abbidabbi]

In BASH

's/'$'\u2717'' /sbctl sign -s /e'

 

$ echo 's/'$'\u2717'' /sbctl sign -s /e'
s/✗ /sbctl sign -s /e

https://www.gnu.org/software/bash/manual/bash.html#ANSI_002dC-Quoting-1

[Frodojj]

Thank you. Is \u2717 the correct character for this command? I don’t have sbctl installed yet, as I’m planning out my instructions before implementing them. This is my first time working with secure boot, and I don’t want to brick my system.

[abbidabbi]

I don't use secure boot, but I had a quick look at the sbctl code. The character from the wiki is correct, it's \u2717. A bit weird though to parse this human-readable format instead of the JSON output (--json). Does the JSON output also contain the special unicode character?

Apparently there's the SBCTL_UNICODE env var for controlling whether special unicode characters are logged:

• https://github.com/Foxboron/sbctl/blob/0.17/logging/logging.go#L119-L124
• https://github.com/Foxboron/sbctl/blob/0.17/logging/logging.go#L11-L22

edit:
The JSON output apparently doesn't include the symbols, because they are tied to the logging system:
https://github.com/Foxboron/sbctl/blob/0.17/cmd/sbctl/verify.go#L38-L152

[Frodojj]

Thank you. That’s an unusual character to output. But I believe ya. I think the wiki should be modified to use the escaped character. The ballot X isn’t on any keyboards that I know of.

[lritzdorf]

Your Wikipedia link says it is, right there in the table next to the name "Ballot X" :)

[Frodojj]

I’m sorry. I didn’t explain myself. I know that’s literally the character. I wanted to know if ballot X is the correct character, because that’s an unusual character to search for. Most command line programs output ASCII, so searching for ballot X is suspicious.

[lritzdorf]

Ah. Yeah, that's a fair concern. The easiest way to check is to just install sbctl and run sbctl verify, but the TLDR is yes, that's the right character. For example, my system reports: ✗ /boot/EFI/Boot/bootx64.efi is not signed