CCSecureBoot

CCSecureBoot implements boot security for CC: Tweaked computers. Installation means placing the built JAR in the mods folder alongside CC: Tweaked, which is required. The mod operates on the server only, so multiplayer clients need nothing installed. Enrollment starts with the enroll-secure-boot command, which first presents a summary of the protections it provides and waits for confirmation before continuing, then prompts for a password for the key. Setting a password is optional but recommended, to guard against accidental key leakage. If no disk is detected, the command waits until a key disk is inserted.

Once enrollment is ready, a key is generated and saved to the key disk, with a recovery boot configuration placed on the same disk. After Secure Boot is enabled, a computer only boots files that carry a signature beside them. Files are signed with the sign command, which creates a .sig file next to the program, using the key disk in a drive. Secure Boot disables direct shell access. Only startup.lua is booted by default, and it must be signed. Holding a key disk in the drive during boot brings up a menu with an option to start the shell.

Secure Boot is disabled with unenroll-secure-boot, run on a computer with the key card inserted. An unenrolled computer can no longer boot, and its boot files cannot be modified. Keys can be revoked to block abuse after a leak, and a lost key leaves no way to recover the computer, so the key disk should be kept safe and away from other players. The mod does not protect against every program: holding Ctrl+T terminates the shell when a disk with a startup file is inserted. Ideally programs should handle terminate events safely instead of erroring. For developers, CCSecureBoot exposes a library built on the same code the boot manager uses, for code signing.