It appears that Grub-EFI will only boot a "signed" Linux kernel. Is there some command that will allow me to query a given kernel image to find out what signatures (if any) are present on it?
It depends on what kind of signature you're talking about. If you have an EFI system, you can have signed EFI executables (
Unfortunately I didn't see an easy way of extracting and displaying the EFI signature. :(
What's more likely what you are looking for is GRUB's own ability to check its modules and kernels to be booted for valid signatures (Secure Boot just affects the GRUB binary itself, everything GRUB loads does not necessarily need to be EFI-signed). Those are (as far as I understand) plain old detached GPG signatures (so for example for a kernel called
If you don't have a
You can disable signature checking in GRUB by entering
Using the information provided by Andreas, I was able to figure out the following:
On the working system, both Grub-EFI itself and the Linux kernel are signed with the same key. On the non-working system, neither Grub nor the Linux kernel are signed. When I try to copy the Linux kernel from one system to the other, Grub complains that the kernel is not signed. There is no detatched GPG signature; it appears Grub is looking for the same thing that Secure Boot is looking for - an internal PE signature.
Now, if I can just figure out how to get OpenSUSE to sign their 32-bit version of the Linux kernel...