Breadway/bos
1
0
Fork 0
Code Issues 5 Pull requests 1 Projects Releases 9 Packages Wiki Activity Actions

Secure Boot enrollment produces a GRUB that refuses to boot #54

Merged
Breadway merged 3 commits from fix/bos-24-secure-boot-grub into main 2026-10-02 14:17:11 +08:00
Conversation 2 Commits 3 Files changed 2 +55 -16
Breadway commented 2026-09-30 01:15:51 +08:00
Owner
Copy link

The installer now detects UEFI Setup Mode before installing GRUB and builds it with shim-lock disabled, SBAT metadata, and the required filesystem, crypto, and boot modules. It saves signatures for both EFI GRUB binaries and the installed kernel in sbctl's database.

Verified with bash -n, git diff --check, GRUB option inspection, an EFI image build using the configured modules, and a successful FAST_BUILD=1 ISO build. The build emitted the existing nbd-client initramfs hook warning. The installed-OS OVMF checks remain outstanding: booting after Secure Boot is enabled and booting again after pacman -S linux.

Closes #24

The installer now detects UEFI Setup Mode before installing GRUB and builds it with shim-lock disabled, SBAT metadata, and the required filesystem, crypto, and boot modules. It saves signatures for both EFI GRUB binaries and the installed kernel in sbctl's database. Verified with `bash -n`, `git diff --check`, GRUB option inspection, an EFI image build using the configured modules, and a successful `FAST_BUILD=1` ISO build. The build emitted the existing `nbd-client` initramfs hook warning. The installed-OS OVMF checks remain outstanding: booting after Secure Boot is enabled and booting again after `pacman -S linux`. Closes #24
Breadway commented 2026-09-30 03:58:32 +08:00
Author
Owner
Copy link

This PR card tracks BOS-24 / PR #54. Fresh Setup Mode OVMF Secure Boot and kernel re-sign acceptance is still missing; reviewer found the PR unmergeable. Parent BOS-24 is TODO. Synchronizing card status to TODO.

This PR card tracks BOS-24 / PR #54. Fresh Setup Mode OVMF Secure Boot and kernel re-sign acceptance is still missing; reviewer found the PR unmergeable. Parent BOS-24 is TODO. Synchronizing card status to TODO.
Merge remote-tracking branch 'origin/main' into HEAD
All checks were successful
Build and publish calamares / calamares (push) Successful in 3m46s
Details
Build and publish powerlevel10k / powerlevel10k (push) Successful in 3m20s
Details
Build and publish calamares / calamares (pull_request) Successful in 5m51s
Details
1333dbe78b 
# Conflicts:
#	CHANGELOG.md
Breadway commented 2026-10-01 16:26:25 +08:00
Author
Owner
Copy link

PR #54 has the implementation and static GRUB/signing checks recorded on the rebased head. Fresh Setup Mode OVMF install, Secure Boot boot, sbctl status, and post-kernel-update boot acceptance remain outstanding; BOS has no ordinary push CI. Moving the implementation to REVIEW for the requested handoff. Do not treat as verified or done until those acceptance checks are recorded.

PR #54 has the implementation and static GRUB/signing checks recorded on the rebased head. Fresh Setup Mode OVMF install, Secure Boot boot, sbctl status, and post-kernel-update boot acceptance remain outstanding; BOS has no ordinary push CI. Moving the implementation to REVIEW for the requested handoff. Do not treat as verified or done until those acceptance checks are recorded.
# Conflicts:
#	CHANGELOG.md
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
P0

   
P1

   
P2

   
P3

   
audio

   
bakery

   
boot

   
breadbug

   
bug

   
build

   
ci

   
dependencies

   
design

   
disk

   
docs

   
encryption

   
final

   
firewall

   
graphics

   
hardware

   
idle

   
installer

   
keybinds

   
nvidia

   
packages

   
phase-1

   
polish

   
recovery

   
reliability

   
reproducibility

   
secure-boot

   
security

   
shell

   
signing

   
snapshots

   
supply-chain

   
swap

   
tech-debt

   
theming

   
ux

   
website
No labels
P0
P1
P2
P3
audio
bakery
boot
breadbug
bug
build
ci
dependencies
design
disk
docs
encryption
final
firewall
graphics
hardware
idle
installer
keybinds
nvidia
packages
phase-1
polish
recovery
reliability
reproducibility
secure-boot
security
shell
signing
snapshots
supply-chain
swap
tech-debt
theming
ux
website
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/bos!54
No description provided.