Page MenuHomeSolus

clr-boot-manager: Switch to shim-systemd-boot for secure boot support
ClosedPublic

Authored by joebonrichie on Dec 15 2022, 1:08 PM.
Tags
None
Referenced Files
F11021338: D13867.id33836.diff
Mon, Aug 7, 1:46 PM
F11018370: D13867.id33835.diff
Sun, Aug 6, 11:34 AM
F10952542: D13867.id34465.diff
Sun, Jul 16, 5:03 PM
F10951840: D13867.id33884.diff
Sun, Jul 16, 1:47 PM
F10951839: D13867.id33913.diff
Sun, Jul 16, 1:46 PM
F10951838: D13867.id33907.diff
Sun, Jul 16, 1:46 PM
F10951837: D13867.id33847.diff
Sun, Jul 16, 1:46 PM
F10951337: D13867.id.diff
Sun, Jul 16, 11:10 AM
Subscribers
None

Details

Summary

Switch to shim-systemd-boot for secure boot support. After installing this update and running clr-boot-manager update,
clr-boot-manager will auto setup shim & systemd-boot and create a new UEFI boot entry called 'Solus Linux Bootloader'
which should be able to be booted from with Secure Boot enabled after performing the one step time of enrolling the
solus certificate from the Mok Management screen.

Test Plan
  • Install this package and reboot WITHOUT running clr-boot-manager update
  • If a kernel update is available: Install the kernel update and reboot
  • If no kernel update is available: Run clr-boot-manager update and reboot
  • Attempt to boot from the old UEFI entry
  • Attempt to boot from the new 'Solus Linux Bootloader' UEFI entry
  • Reboot and enable secure boot, enroll default keys if neccessary
  • If your UEFI firmware provides such an option: Set the 'Image Execution Policy' to 'Deny Execute' upon secure boot violation (names may vary).
  • Attempt to boot from the old UEFI entry (should fail with secure boot violation)
  • Attempt to boot from the new 'Solus Linux Bootloader' entry
  • This should launch Mok Manager with a warning about a security violation. Press enter to continue then choose 'Enroll Key from Disk'. Enroll 'SOLUSESP/solus-enroll-me.cer'.
  • Reboot, and you should successfully boot.

Diff Detail

Repository
R3347 clr-boot-manager
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

joebonrichie edited the test plan for this revision. (Show Details)

Fix typo in testing

joebonrichie edited the summary of this revision. (Show Details)
joebonrichie edited the test plan for this revision. (Show Details)

Auto-copy the MOK to the ESP

Add missing rundep for shim-signed

There is a bug where mmx64.efi doesn't get copied into the ESP. Seen it happen twice now.

Ensure mmx64.efi is copied over to the ESP as well

joebonrichie edited the test plan for this revision. (Show Details)

Update test plan

joebonrichie edited the summary of this revision. (Show Details)
joebonrichie edited the test plan for this revision. (Show Details)
  • Rebase ontop of D13505
  • Use American English spelling of 'Enroll' consistently
joebonrichie edited the summary of this revision. (Show Details)

Signed kernels are now available

joebonrichie edited the summary of this revision. (Show Details)

Testing new arcanist version...

This revision was not accepted when it landed; it landed in state Needs Review.May 21 2023, 5:25 PM
This revision was automatically updated to reflect the committed changes.