Secure boot support available in the Unstable repository

joebonrichie

Please refer to the documentation to enable secure boot on an existing install here: https://help.getsol.us/docs/user/quick-start/installation/secure-boot/#enabling-secure-boot-on-an-existing-install

For the 4.4 ISO, secure boot will be enabled by default for new installs.

Let us know of any problems

johano

joebonrichie, good instructions, and succeeded in getting secure boot here also.

I needed to install efivar-38-4-1-x86_64.eopkg from the unstable repo before clr-boot-manager would install, and then to run clr-boot-manger update (as instructions mention), before solus-enroll-me.cer turned up in the /boot folder of the ESP.

WetGeek

joebonrichie For the 4.4 ISO, secure boot will be enabled by default for new installs.

Has anyone asked how important it is for us to implement secure boot now? I know that Windows now requires that devices support it, but not necessarily actually use it. But what advantages accrue to those of us who might go to the trouble of implementing it before it becomes part of 4.4?

Seems to be a cost/benefit decision. I have a good idea of the costs by now, but no idea what benefits are involved.

andiskufi

I can't see that screen as it's saying that "aha tool" is missing.

joebonrichie

andiskufi Partially resolved in unstable but it also needs https://dev.getsol.us/D13506

You can use bootctl | grep "Secure Boot" to confirm

minh

~~Where could I find this file solus-enroll-me.cer without downloading the ISO?~~
Found it

joebonrichie

minh From our systemd package.

wget https://packages.getsol.us/unstable/s/systemd/systemd-251.15-113-1-x86_64.eopkg
unzip systemd-251.15-113-1-x86_64.eopkg
tar xf install.tar.xz
cp install/usr/lib/systemd/boot/solus-mok.cer .

I'm curious as to why?

minh

joebonrichie I'm curious as to why?

I was reading the document and thought this file was only available from the ISO file (as part of "Preparing to Install"), but I found it later just following the instruction 🙂

For one who does know about secure boot, I found this link What Is Secure Boot and How Does it Work?

PS: I have it enabled on mine now. Thank you

❯ bootctl status | grep "Secure Boot" Couldn't find EFI system partition. It is recommended to mount it to /boot or /efi. Alternatively, use --esp-path= to specify path to mount point. Secure Boot: enabled (user)

hakimjonas

WetGeek perhaps it could simplify installation for less tech-savy users?

skinj0b

WetGeek I know this post is a tad aged but I use it, would like to see it as an option even if some others do not. I know it has been a hot topic for debate since it first appeared on the scene but it is still a great offering for those of us that actually prefer to use it. You know the old adage, it's better to have and not need than need and not have. 😉

WetGeek

hakimjonas perhaps it could simplify installation for less tech-savy users?

By that, you mean there'd be no need for them to open the BIOS/UEFI settings to turn OFF secure boot in order to install Solus? That's something I hadn't thought of, and you coud be right.

hakimjonas

WetGeek of course there could be benefits that are more important that, but that was what I meant :-)

WetGeek

hakimjonas that was what I meant

I was looking for a reason to do that manually right now, for all the Solus devices here, rather than just wait for 4.4. If that's indeed the only advantage, it makes sense to wait and let the installer do it.

FAb7D

The last time I used secure boot was with opensuse, I remember that when it was time to use qemu I had to go through a complicated procedure to get the certificates whose result was so disastrous that I switched to Solus.

WetGeek

FAb7D result was so disastrous that I switched to Solus

Sounds like a great outcome!

olivir

FAb7D I also told myself that it would be a problem nest, your testimony confirms.

WetGeek

skinj0b would like to see it as an option even if some others do not.

It's my understanding that it was coming as an option in Solus 4.4, which is what we've been using for a long time now. With absolutely no need for it, I haven't been interested in figuring out how to turn it on, so I can't help you with that.

I did a forum search for "secure boot" and got plenty of results. Is nothing there helpful for you?

penny-farthing

My computer boots to Solus Linux Bootloader and launches correctly my Solus Budgie session.

While reading this post which is coming back to the forefront on this forum, I noticed that the next command gives the following result:

I precise that my computer is running in dual boot mode, as shown by this screenshot from Gparted:

What should I do and how, please?