I'm trying to create a new image of GRUB which has an embedded public key file to validate all files loaded by GRUB. So I used the command grub-mkimage to manually create a new GRUB core image.
grub-mkimage --config='./grub.cfg' --compression='auto' --pubkey='./grub.key' --output='./core_custom.efi' --format='x86_64-efi' --prefix='(hd0,gpt2)/grub' --verbose ext2 fshelp part_gpt pbkdf2 crypto password_pbkdf2 pbkdf2_test
The grub.cfg contains a superuser with a pbkdf2 password (that's why I included the pbkdf2 modules) to prevent manipulating the config so that the password protection becomes not loaded. Also I set the variable pager to 1.
But after rebooting my computer and booting from the newly created GRUB image the GRUB environment variable check_signatures is not set to enforce (like mentioned in the official GRUB2 manual), the key I passed to the grub-mkimage command is not listed when I enter the list_trusted command in the GRUB shell and finally the verify_detached command does not find the public key.
But the verbose log of the grub-mkimage command clearly states that the key was read and when I load the key manually in the GRUB shell everything works fine.
Information about my installation:
-EFI platform -> GRUB x86_64-efi