Comments

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
14 comments in c/linux@programming.dev view that post
[–] 14 points 1 year ago (2 children)

What a terrible system. I have a couple of computers where the vendor provides good update support, but for most of them this is not the case and you're pretty much stuck with the firmware you get. To tie Secure Boot to such a flaky set of distribution channels seems like very poor planning.

  • source
  • hideshow 2 child comments
  • [+] 6 points 1 year ago (9 children)
  • [–] 5 points 1 year ago (6 children)

    Was your bios updated in the last few years? Not when you updated it, but when the manufacturer pushed a newer update.

    If it's older than 2023 then you're screwed. If it's been updated since then then you're probably fine.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 3 points 1 year ago*

    Screwed just means you'll have to turn off Secure Boot if you ever want to reinstall Linux. And on many PCs the Secure Boot has been so badly implemented it's pretty worthless anyway. Several of mine have a root key called something like "AMI TEST KEY - DO NOT TRUST" which basically invalidates the whole system and is unfixable by the user.

  • source
  • parent
  • [+] 2 points 1 year ago (4 children)
  • [–] 2 points 1 year ago (3 children)

    They're asking for the newest version of firmware available, not the one you have installed. Check the website of your motherboards manufacturer to see if they have anything.

  • source
  • parent
  • hideshow 3 child comments
  • Would this not also be an issue for Windows users? Or is the Windows boot loader signed with a different key?

  • source
  • 5 comments in c/linux@lemmy.ml view that post
    [–] 4 points 1 year ago (1 child)

    So, if I've not had a UEFI update in to update the Secureboot cert, wouldn't this affect any OS? Ie Windows too?

  • source
  • hideshow 1 child comment
  • [–] 4 points 1 year ago (2 children)
  • [–] 9 points 1 year ago* (last edited 1 year ago)

    The answer as always is, it depends.

    Not all implementations rely on shim.

    if you set up secureboot without doing anything more than instaling the OS.... yeah probably it is true. Edit: e.g. GRUB2 generally relies on shim. sysemd-boot doesn't

    I haven't checked the specific key that signs shim to confirm the expiration date, but there generally is a date, as we're talking about certs and keys here.

    Edit 2: Basically what this article is saying is that the machines will need a new platform key (mited in 2023) enrolled in the tpms, with often comes from the firmware (when tpms are wiped for initial enrollment of a new install/setup, they tend to enroll whatever platform keys from microsoft are baked in to the uefi firmware).

    So basically, if you haven't had a bios/uefi firmware update since 2022, there's no way for you to have have the new key trusted by your tpm, and the whole chain of trust falls apart when the key you do have expires. So you'll need to disable secureboot. If you use shim and/or the microsoft platform key in someway.

  • source
  • parent