Ubuntu release frequent builds from the upstream Linux kernel source code tree. However, not all Ubuntu mainline kernels are published in an APT repository. The CA certificate is stored in the bootloader packages to validate the kernel signatures. Ubuntu signs kernels that they distribute through the default APT repositories. Secure Boot prevents the bootloader from starting distrusted executables. This is because the rouge software has not been signed by a trusted source. It protects users by preventing user-space programs from installing malicious bootloaders and binaries. It does this by verifying that the binaries have been signed by a trusted source, such as Ubuntu.

Secure Boot ensures that grub and any operating system kernels are trustworthy. Entries registered in grub allow starting up different Linux kernels or operating systems. In the context of Linux, the bootloader is usually the grub package. UEFI starts bootloaders for operating systems installed on storage devices in the computer. Secure Boot (SB) is a verification mechanism for ensuring that code launched by a computer's UEFI firmware is trustworthy. Automated signing of kernels installed with Mainline.Automated signing of all installed kernels.Post-installation scripts that automate signing of kernels with a MOK.

Create and enrol Machine Owner Key (MOK) for signing kernels.

This allows the signed kernels to boot on UEFI Secure Boot enabled computers. The purpose of this repository is to explain how to sign Ubuntu kernels using a Machine Owner Key. Ubuntu UEFI Secure Boot with Mainline/Custom Kernels

Malwarebytes 3.6.1 key code