Secure Boot Chain of Trust

When to use

• Implementing or reviewing UEFI Secure Boot: key enrollment, image signing, db/dbx management, or a "Verification failed / EFI_SECURITY_VIOLATION" boot failure.
• Working with shim and MOK (Machine Owner Keys) to boot a distro with self-signed keys under Secure Boot.
• Reviewing Linux kernel/module signature enforcement (CONFIG_MODULE_SIG_ENFORCE, built-in x509 keyring, lockdown).
• Implementing or auditing Android Verified Boot 2.0: vbmeta, chain descriptors, rollback protection.
• Answering "is Secure Boot actually enforcing anything here?" — the answer requires walking the whole chain, not reading one flag.

When not to use