---
name: "sbvarsign"
section: "1"
platform: "linux"
package: "sbsigntools"
version: "0.9.5-4"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/sbvarsign"
---

# sbvarsign(1)

UEFI authenticated variable signing tool

## NAME

sbvarsign - UEFI authenticated variable signing tool

## SYNOPSIS

**sbvarsign** \[*options*\] *--key \<keyfile\> --cert \<certfile\> \<var-name\> \<var-data-file\>*

## DESCRIPTION

Sign a blob of data for use in SetVariable().

## OPTIONS

- **--engine** \<eng\>

  use the specified engine to load the key

- **--key** \<keyfile\>

  signing key (PEM-encoded RSA private key)

- **--cert** \<certfile\>

  certificate (x509 certificate)

- **--include-attrs**

  include attrs at beginning of output file

- **--guid** \<GUID\>

  EFI GUID for the variable. If omitted, EFI\_IMAGE\_SECURITY\_DATABASE or EFI\_GLOBAL\_VARIABLE (depending on \<var-name\>) will be used.

- **--attr** \<attrs\>

  variable attributes. One or more of: NON\_VOLATILE BOOTSERVICE\_ACCESS RUNTIME\_ACCESS TIME\_BASED\_AUTHENTICATED\_WRITE\_ACCESS APPEND\_WRITE

- Separate multiple attrs with a comma,

  default is all attributes, TIME\_BASED\_AUTH... is always included.

- **--output** \<file\>

  write signed data to \<file\> (default \<var-data-file\>.signed)