Secure Boot distribution support
Dec. 27th, 2012 07:02 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
mjg59It's after Christmas, and some number of people doubtless ended up with Windows 8 PCs and may want to install Linux on them. If you'd like to do that without fiddling with firmware settings, here are your options.
- Ubuntu 12.10
The 64-bit version of Ubuntu 12.10 ships with an older version of Shim that's been signed by Microsoft. It should boot out of the box on most systems, but it doesn't have some of the most recent EFI patches that improve compatibility on some machines. Grab it here. - Fedora 18
Fedora 18 isn't quite released yet, but the latest 64-bit test builds include a Microsoft signed copy of the current version of Shim, including the MOK functionality described here. Fedora 18 has some additional EFI support patches that have just been merged into mainline, which should improve compatibility on some machines - especially ones with Radeon graphics. It also has improved support for booting on Macs. You can get it here, but do bear in mind that it's a test release. - Sabayon
According to the wiki, Sabayon now supports UEFI Secure Boot out of the box. I don't know if the current CD images do, though. My understanding is that it's based on the Microsoft signed Shim I discussed here, and you'll have to manually install the key once you've booted the install media. Straightforward enough. - Other distributions
Suse will be using a version of Shim signed by Microsoft, but I don't think it's in any pre-release versions yet. Debian have just merged UEFI support into their installer, but don't have any UEFI Secure Boot support at the moment. I'm not sure what other distributions are planning on doing, but let me know and I'll update the list. - The Linux Foundation loader
The Linux Foundation have still to obtain a signed copy of their bootloader. There's no especially compelling reason to use it - the use case it supports is where you have users who can follow instructions sufficiently to press "y" but not to choose to enrol a key. The most interesting feature it has is the ability to use the MOK database via the usual UEFI LoadImage and StartImage calls, which means bootloaders like gummiboot work. Unfortunately it implements this by hooking into low-level functionality that's not actually required to be present, so relying on this may be somewhat dubious.
About Sabayon
Date: 2012-12-28 03:25 pm (UTC)Re: About Sabayon
Date: 2012-12-30 01:16 am (UTC)Sam Varghese
Thanks for this list
Date: 2012-12-29 07:03 pm (UTC)2. Microsoft's real aim is to kill the aftermarket in used computers that have Win 8 installed by not allowing you to install something other than Windows. That's why this work is so important.
Re: Thanks for this list
Date: 2012-12-29 07:27 pm (UTC)Microsoft could just have refused to sign UEFI bootloaders. They didn't. That doesn't really fit in with what you're claiming.
Re: Thanks for this list
Date: 2012-12-29 08:08 pm (UTC)Re: Thanks for this list
Date: 2012-12-29 08:10 pm (UTC)Re: Thanks for this list
Date: 2012-12-30 11:57 am (UTC)Let's say all the mobile devices get populair and the PC is in sharp decline.
Now Microsoft thinks they can claim their monopoly isn't monopoly anymore and all older Windows operating systems have become obsolete.
Now they have a chance to change their policy which is: All Windows X devices including x86/amd64 should have Secure boot enabled and no disable button.
Will their policy on accepting signing of Linux boot binaries change ? How long is the old signatures valid anyway ?
Lots of servers already have TPM devices, ARM servers are coming. Microsoft might as well have the same policy for all servers and demand TPM for their next Windows Server operating systems (probably least likely).
There are just to many what-ifs and it depends on the actions of a competitor. I don't like it.
Re: Thanks for this list
Date: 2012-12-29 09:20 pm (UTC)Re: Thanks for this list
Date: 2012-12-30 01:20 am (UTC)Re: Thanks for this list
Date: 2012-12-30 08:32 pm (UTC)Any manual action required beyond "insert install disc and boot from it" is an obstacle to installation.
Re: Thanks for this list
Date: 2012-12-30 08:36 pm (UTC)Re: Thanks for this list
Date: 2012-12-31 03:27 am (UTC)Sabayon Linux
Date: 2012-12-30 12:43 am (UTC)Sam Varghese
Re: Sabayon Linux
Date: 2012-12-30 08:29 am (UTC)Re: Sabayon Linux
Date: 2012-12-30 10:45 pm (UTC)Sam
Re: Sabayon Linux
Date: 2012-12-30 06:47 pm (UTC)"According to the wiki, Sabayon now supports UEFI Secure Boot out of the box."
You see those four words at the start? The ones that read "According to the wiki"? Now, if you look at the rest of the sentence, it would have made perfect sense without them! So why did Matthew put them in there? Why, to explicitly alert you to the fact that he is repeating information he gleaned elsewhere, not stating first-hand knowledge. He just specifically told you that he is repeating what the Sabayon wiki says, not telling you something he knows himself.
If that's not enough for you, the entire next sentence also represents a clear hint:
"I don't know if the current CD images do, though."
If Matt had actually *tried* them, it seems quite likely that he would know.
And then finally you have the very next sentence:
"My understanding is that it's based on the Microsoft signed Shim I discussed here, and you'll have to manually install the key once you've booted the install media."
Once again, if Matt had actually tried this, he wouldn't have to tell you his 'understanding', he would know.
Re: Sabayon Linux
Date: 2012-12-30 10:46 pm (UTC)I have asked the question to confirm that this kind of wrong information comes from a secondary source.
Sam
Re: Sabayon Linux
Date: 2013-01-02 07:17 pm (UTC)-Joseph G. Mitzen
Re: Sabayon Linux
Date: 2012-12-30 11:15 pm (UTC)Re: Sabayon Linux
Date: 2012-12-30 11:58 pm (UTC)How do they install if the images do not work?
Sam
Re: Sabayon Linux
Date: 2012-12-31 12:01 am (UTC)Re: Sabayon Linux
Date: 2012-12-31 12:46 am (UTC)You tell them about images which you do not know about - and you don't see that it contradicts your very own stated purpose?
In that case, I give up, there is no point in arguing further.
Sam
Re: Sabayon Linux
Date: 2012-12-31 07:53 am (UTC)Other options - Chromebooks/Chromeboxes/Raspberry Pi/Server Hardware
Date: 2012-12-31 12:10 am (UTC)The Raspberry Pi is another option for low level hacking and embedded type devices, and there is cheap ix86 server hardware with superb Linux support, and many of these are cheaper than desktop PC hardware.
Re: Other options - Chromebooks/Chromeboxes/Raspberry Pi/Server Hardware
Date: 2012-12-31 03:29 am (UTC)Big distros aren't the only one.
Date: 2012-12-31 10:56 am (UTC)It uses your shim, refind, and grub2. Thanks for your effort, Matthew. Otherwise small distros like us can't possibly get up and running with Secure Boot in such a short time.
Disclaimer: I'm the co-maintainer of Fatdog64.
James
Ubuntu 12.04 LTS
Date: 2012-12-31 01:52 pm (UTC)Thanks
Re: Ubuntu 12.04 LTS
Date: 2012-12-31 04:34 pm (UTC)Bill, Hell called, they are waiting for you!
Date: 2013-01-01 01:23 am (UTC)Re: Bill, Hell called, they are waiting for you!
Date: 2013-01-02 07:24 pm (UTC)The real issue is with ARM devices mandating that Windows RT be permanently locked to the device. This means that nice ARM laptops will be coming out that will lock Linux out. We need to stop crying Wolf over the desktop - we WON on the desktop. MS was originally taking a "it will be up to the OEMs if they want to allow disabling secure boot *wink* *wink*" position, and we got them to change it. Battle over. Now we need to turn our attention to ARM and quit wasting energy over a battle we've already won.
Re: Bill, Hell called, they are waiting for you!
Date: 2013-11-29 01:25 pm (UTC)--
Michael Shigorin
Corrections are in order
Date: 2013-01-01 10:13 pm (UTC)Are you going to be honest enough to write and tell the author that there are lacunae in what you have posted? Or will you continue to let misinformation be fed to the public?
Sam
Re: Corrections are in order
Date: 2013-01-01 10:54 pm (UTC)Re: Corrections are in order
Date: 2013-01-02 08:33 pm (UTC)By the way, this is somewhat pathetic for a Linux journalist to be freaking out like this and attacking a simple blog post incessantly. You're embarrassing yourself.
About Sabayon
Date: 2013-01-02 03:51 pm (UTC)http://lxnay.wordpress.com/2013/01/02/uefi-and-uefi-secureboot-linux-is-the-nightmare-over/
The voice of Microsoft
Date: 2013-01-03 08:34 am (UTC)Matthew thanks for the article it was interesting where as the comments are just trolling rants, which is why I stopped commenting on stuff like this but Sam just wound me up enough with his trolling that I had to respond. Right i'm off out in to the real world now, no doubt the trolls and fanboys will still be here if I ever return.
ALT Linux half-regular build too
Date: 2013-01-10 12:02 am (UTC)It's shim-signed + elilo signed by pre-generated key, I'm considering the ways to get the proper keys through the build infrastructure (probably a separate bit and a lightweight HSM looms either).
Boots in non-SB virtualbox-4.2 and on ASUS UX31A with SB turned back on.
--
Michael Shigorin
uefi boot
Date: 2013-02-11 04:52 am (UTC)uefi boot
Date: 2013-02-11 04:54 am (UTC)