Secure Boot enrollment produces a GRUB that refuses to boot

Breadway commented

2026-09-26 07:27:39 +08:00

Owner

Problem

When the firmware is in Setup Mode, post-install runs sbctl create-keys && sbctl enroll-keys --microsoft && sbctl sign-all -g. But GRUB was installed (lines 201-206) without --disable-shim-lock, --sbat or built-in modules. Under Secure Boot without shim, upstream GRUB's shim_lock verifier rejects the kernel ("prohibited by secure boot policy") and won't insmod unsigned modules from /boot/grub/x86_64-efi/. So the enrolled path, the only path that sets Secure Boot up at all, most likely ends in an unbootable system. The kernel at /boot/vmlinuz-linux also needs to be in sbctl's database so its pacman hook re-signs it.

Where

iso/airootfs/etc/calamares/post-install.sh lines 197-220 and 236-247.

Fix

When Secure Boot will be enrolled (decide SETUP_MODE before grub-install), install GRUB with --disable-shim-lock --sbat /usr/share/grub/sbat.csv --modules="<all needed: part_gpt part_msdos btrfs fat all_video gfxterm tpm cryptodisk luks luks2 gcry_* normal search ...>", following the Arch Wiki's "Unified Extensible Firmware Interface/Secure Boot" GRUB section.
sbctl sign -s each of EFI/BOS/grubx64.efi, EFI/BOOT/BOOTX64.EFI and /boot/vmlinuz-linux, so they're saved in sbctl's database for the hook.
Or switch to a signed UKI plus systemd-boot. That's a much bigger change, so open a separate design issue for it.

Acceptance

OVMF VM in Setup Mode: install, then enable Secure Boot in the firmware. The machine boots, and sbctl status shows Secure Boot enabled with all files signed.
pacman -S linux afterwards: it still boots (the pacman hook re-signs).

Source: BOS v0.6.2 source review (tag dated 2026-09-19); paths and line numbers refer to that tree. Read AGENTS.md first. One issue per branch/PR, match existing style. Verify with FAST_BUILD=1 sudo ./build-local.sh plus an OVMF VM with a Setup-Mode varstore (fresh OVMF_VARS copy per test). Add a CHANGELOG [Unreleased] entry.

## Problem When the firmware is in Setup Mode, post-install runs `sbctl create-keys && sbctl enroll-keys --microsoft && sbctl sign-all -g`. But GRUB was installed (lines 201-206) without `--disable-shim-lock`, `--sbat` or built-in modules. Under Secure Boot without shim, upstream GRUB's shim_lock verifier rejects the kernel ("prohibited by secure boot policy") and won't `insmod` unsigned modules from `/boot/grub/x86_64-efi/`. So the enrolled path, the only path that sets Secure Boot up at all, most likely ends in an unbootable system. The kernel at `/boot/vmlinuz-linux` also needs to be in sbctl's database so its pacman hook re-signs it. ## Where `iso/airootfs/etc/calamares/post-install.sh` lines 197-220 and 236-247. ## Fix - When Secure Boot will be enrolled (decide `SETUP_MODE` before grub-install), install GRUB with `--disable-shim-lock --sbat /usr/share/grub/sbat.csv --modules="<all needed: part_gpt part_msdos btrfs fat all_video gfxterm tpm cryptodisk luks luks2 gcry_* normal search ...>"`, following the Arch Wiki's "Unified Extensible Firmware Interface/Secure Boot" GRUB section. - `sbctl sign -s` each of `EFI/BOS/grubx64.efi`, `EFI/BOOT/BOOTX64.EFI` and `/boot/vmlinuz-linux`, so they're saved in sbctl's database for the hook. - Or switch to a signed UKI plus systemd-boot. That's a much bigger change, so open a separate design issue for it. ## Acceptance - OVMF VM in Setup Mode: install, then enable Secure Boot in the firmware. The machine boots, and `sbctl status` shows Secure Boot enabled with all files signed. - `pacman -S linux` afterwards: it still boots (the pacman hook re-signs). --- Source: BOS v0.6.2 source review (tag dated 2026-09-19); paths and line numbers refer to that tree. Read AGENTS.md first. One issue per branch/PR, match existing style. Verify with `FAST_BUILD=1 sudo ./build-local.sh` plus an OVMF VM with a Setup-Mode varstore (fresh `OVMF_VARS` copy per test). Add a CHANGELOG `[Unreleased]` entry.

Breadway added the

labels

2026-09-26 07:27:40 +08:00

Breadway referenced this issue from a pull request that will close it,

2026-09-30 01:15:51 +08:00

Secure Boot enrollment produces a GRUB that refuses to boot #54

Breadway commented

2026-09-30 01:15:57 +08:00

Author

Owner

PR: #54

Implemented Setup Mode GRUB installation with shim-lock disabled, SBAT metadata, built-in modules, and saved signatures for both EFI GRUB binaries and /boot/vmlinuz-linux. bash -n, git diff --check, GRUB option inspection, EFI image generation with the configured modules, and FAST_BUILD=1 ISO build passed. The build reported its existing nbd-client initramfs hook warning.

The installed-OS acceptance checks remain outstanding: this ISO has not been installed in a fresh Setup Mode OVMF VM, Secure Boot has not been enabled to confirm the installed system boots, and pacman -S linux has not been run to confirm the sbctl hook re-signs the kernel and it still boots. Leaving this issue in DOING until those checks are completed.

PR: https://git.breadway.dev/Breadway/bos/pulls/54 Implemented Setup Mode GRUB installation with shim-lock disabled, SBAT metadata, built-in modules, and saved signatures for both EFI GRUB binaries and `/boot/vmlinuz-linux`. `bash -n`, `git diff --check`, GRUB option inspection, EFI image generation with the configured modules, and `FAST_BUILD=1` ISO build passed. The build reported its existing `nbd-client` initramfs hook warning. The installed-OS acceptance checks remain outstanding: this ISO has not been installed in a fresh Setup Mode OVMF VM, Secure Boot has not been enabled to confirm the installed system boots, and `pacman -S linux` has not been run to confirm the sbctl hook re-signs the kernel and it still boots. Leaving this issue in DOING until those checks are completed.

Breadway commented

2026-09-30 03:58:11 +08:00

Author

Owner

Independent review of PR #54 found the Setup Mode GRUB flags and signatures present. Acceptance remains unverified: fresh Setup Mode OVMF boot with Secure Boot enabled, sbctl status, and a post-pacman -S linux reboot. Forgejo reports the PR is not mergeable. No VM validation is currently active, so returning BOS-24 to TODO.

Independent review of PR #54 found the Setup Mode GRUB flags and signatures present. Acceptance remains unverified: fresh Setup Mode OVMF boot with Secure Boot enabled, `sbctl status`, and a post-`pacman -S linux` reboot. Forgejo reports the PR is not mergeable. No VM validation is currently active, so returning BOS-24 to TODO.

Breadway commented

2026-10-01 15:59:28 +08:00

Author

Owner

Updated existing PR #54 with current origin/main (5ae8040), resolving the CHANGELOG.md overlap by preserving both entries. Head is 1333dbe78b674f1ac8e9446ebd7a6041c3f56475. bash -n, static Setup Mode GRUB/signing checks, and PR-diff whitespace checks pass. BOS has no ordinary-push CI configured. Fresh Setup Mode OVMF installation, Secure Boot enabled boot, sbctl status, and post-pacman -S linux reboot remain unverified. Root directed no further guest input and no additional VM, so returning BOS-24 to TODO pending those checks.

Updated existing PR #54 with current `origin/main` (5ae8040), resolving the `CHANGELOG.md` overlap by preserving both entries. Head is `1333dbe78b674f1ac8e9446ebd7a6041c3f56475`. `bash -n`, static Setup Mode GRUB/signing checks, and PR-diff whitespace checks pass. BOS has no ordinary-push CI configured. Fresh Setup Mode OVMF installation, Secure Boot enabled boot, `sbctl status`, and post-`pacman -S linux` reboot remain unverified. Root directed no further guest input and no additional VM, so returning BOS-24 to TODO pending those checks.

Breadway commented

2026-10-01 16:26:19 +08:00

Author

Owner

PR #54 has the implementation and static GRUB/signing checks recorded on the rebased head. Fresh Setup Mode OVMF install, Secure Boot boot, sbctl status, and post-kernel-update boot acceptance remain outstanding; BOS has no ordinary push CI. Moving the implementation to REVIEW for the requested handoff. Do not treat as verified or done until those acceptance checks are recorded.

Breadway closed this issue

2026-10-02 14:17:12 +08:00

Breadway referenced this issue

2026-10-15 22:43:46 +08:00

feat: breadbug keybind and crash/freeze notification module #89

Rows
Columns

Secure Boot enrollment produces a GRUB that refuses to boot #24

Problem

Where

Fix

Acceptance