I've recently noticed that GRUB is capable of performing signature checks and software-based secure boot operations. I wanted to give it a try, so I followed the instructions here and executed sudo grub-install --pubkey=<my-key> /dev/sda. The only problem is that even though I properly signed all of GRUB's modules, it is incapable of loading them, including the ones necessary for performing signature checks in the first place. While verify_detached is built into GRUB, I get an error telling me that the hash function for SHA-256 isn't loaded. Does anyone know what I'm doing wrong here?
You need to include the following modules in the core image itself: gcry_rsa gcry_sha256
The --modules option should work.
By the way, while working with this I noticed that GRUB performs no validation at all if you don't include the verify module in the core image. I expected at least an error when specifying --pubkey but not including the verify image.