Secure boot support available in the Unstable repository

joebonrichie

Please refer to the documentation to enable secure boot on an existing install here: https://help.getsol.us/docs/user/quick-start/installation/secure-boot/#enabling-secure-boot-on-an-existing-install

For the 4.4 ISO, secure boot will be enabled by default for new installs.

Let us know of any problems

johano

joebonrichie, good instructions, and succeeded in getting secure boot here also.

I needed to install efivar-38-4-1-x86_64.eopkg from the unstable repo before clr-boot-manager would install, and then to run clr-boot-manger update (as instructions mention), before solus-enroll-me.cer turned up in the /boot folder of the ESP.

WetGeek

joebonrichie For the 4.4 ISO, secure boot will be enabled by default for new installs.

Has anyone asked how important it is for us to implement secure boot now? I know that Windows now requires that devices support it, but not necessarily actually use it. But what advantages accrue to those of us who might go to the trouble of implementing it before it becomes part of 4.4?

Seems to be a cost/benefit decision. I have a good idea of the costs by now, but no idea what benefits are involved.

andiskufi

I can't see that screen as it's saying that "aha tool" is missing.

joebonrichie

andiskufi Partially resolved in unstable but it also needs https://dev.getsol.us/D13506

You can use bootctl | grep "Secure Boot" to confirm

minh

~~Where could I find this file solus-enroll-me.cer without downloading the ISO?~~
Found it

joebonrichie

minh From our systemd package.

wget https://packages.getsol.us/unstable/s/systemd/systemd-251.15-113-1-x86_64.eopkg
unzip systemd-251.15-113-1-x86_64.eopkg
tar xf install.tar.xz
cp install/usr/lib/systemd/boot/solus-mok.cer .

I'm curious as to why?

minh

joebonrichie I'm curious as to why?

I was reading the document and thought this file was only available from the ISO file (as part of "Preparing to Install"), but I found it later just following the instruction 🙂

For one who does know about secure boot, I found this link What Is Secure Boot and How Does it Work?

PS: I have it enabled on mine now. Thank you

❯ bootctl status | grep "Secure Boot" Couldn't find EFI system partition. It is recommended to mount it to /boot or /efi. Alternatively, use --esp-path= to specify path to mount point. Secure Boot: enabled (user)

hakimjonas

WetGeek perhaps it could simplify installation for less tech-savy users?

WetGeek

hakimjonas perhaps it could simplify installation for less tech-savy users?

By that, you mean there'd be no need for them to open the BIOS/UEFI settings to turn OFF secure boot in order to install Solus? That's something I hadn't thought of, and you coud be right.

hakimjonas

WetGeek of course there could be benefits that are more important that, but that was what I meant :-)

WetGeek

hakimjonas that was what I meant

I was looking for a reason to do that manually right now, for all the Solus devices here, rather than just wait for 4.4. If that's indeed the only advantage, it makes sense to wait and let the installer do it.

FAb7D

The last time I used secure boot was with opensuse, I remember that when it was time to use qemu I had to go through a complicated procedure to get the certificates whose result was so disastrous that I switched to Solus.

WetGeek

FAb7D result was so disastrous that I switched to Solus

Sounds like a great outcome!

olivir

FAb7D I also told myself that it would be a problem nest, your testimony confirms.