Re: Bad shim signature on kernel loading with patchset from 25.05.2023 and up

[Tobias Powalowski]

Am Fr., 23. Juni 2023 um 16:02 Uhr schrieb Daniel Kiper <dkiper@net-space.pl>:

On Thu, Jun 22, 2023 at 11:40:47AM +0200, Tobias Powalowski via Grub-devel wrote:
> Hi tackled it down to this commit:
> https://git.savannah.gnu.org/cgit/grub.git/commit/
> ?id=6a080b9cde0be5d08b71daf17a806067e32fc13f

I hope you run the GRUB with this [1] patch. If not please use the
latest upstream master. It has the patch in.

It would be nice if you could give us more information about your shim,
GRUB and kernel versions too.

Daniel

[1] https://lists.gnu.org/archive/html/grub-devel/2023-06/msg00092.html

Hi,

shim and mokmanager is from fedora's signed shim 15.4/15.6 (does not matter both versions don't work) from here:

https://kojipkgs.fedoraproject.org/packages/shim/

Kernel is our latest Arch Linux linux 6.3.9-arch1-1

The kernel image is not signed. Enrolling the kernel hash through MOK manager does not make it bootable anymore, 

reverting back to grub version grub-2.06.r533.g78bc9a9b2 makes it bootable.

Current broken grub is in our core repository:

grub 2.06.r566.g857af0e17-1

All git compiled versions after my mentioned commit are not working, Daniel your mentioned patch was always applied.

greetings

tpowa
--

Tobias Powalowski

Arch Linux Developer & Package Maintainer (tpowa)

https://www.archlinux.org

tpowa@archlinux.org

Archboot Developer

https://archboot.com

St. Martin-Apotheke

Herzog-Georg-Str. 25

89415 Lauingen

https://www.st-martin-apo.de

info@st-martin-apo.de