Secure Boot Support

[bliu13]

Hi, I was wondering if Secure Boot is configured during the installation. I probably did something wrong, but when I finished the installation and rebooted, my Hp Elitebook won't boot the distribution.

From where I am at, I am wondering what I could do to fix the installation as well.

[geckolinux]

Hi there, thanks for the question, and sorry it didn't work as you expected. SecureBoot support is not a priority for SpiralLinux, you would need to disable it in your UEFI settings.

[bliu13]

I actually found the solution. The only thing you need to do is to install the package shim-signed package and your distribution should boot for as long as the UEFI firmware accepts CA certificates signed by Microsoft.

A summary of what I did to save my installation was to first disable Secure Boot, install the shim-signed package, then enable Secure Boot, and you're good to go.

Another weird thing I found was that zstd is not installed by default, so when initramfs is being regenerated, it defaulted to gzip.

[geckolinux]

Hi there, thanks a lot for reporting your findings, it's very helpful.

That's good to know about shim-signed. I was looking at that today too, but I'm not sure if I can make Calamares install that as the bootloader from the initial installation. I've had major trouble with the sb-shim method (as opposed to just plain grub for EFI) in Calamares with GeckoLinux, but it might behave differently in the Debian ecosystem. I'll try to test that more thoroughly, and if I have any success I'll ping you here if you wouldn't mind giving the ISO a quick test spin.

Another weird thing I found was that zstd is not installed by default, so when initramfs is being regenerated, it defaulted to gzip

Hmm, interesting. Are you sure that gzip isn't just the default compression algorithm that Debian uses for the initramfs? I understood that Zstd support was compiled into the kernel for things like Btrfs to take advantage of, whereas I thought the zstd package was a userspace utility for manually compressing files.

[bliu13]

Yeah sure, I can help with testing the new images. I was actually upgrading from stable to unstable to see how things would go. There were some configurations that diverged from the maintainers' version and I was not sure if I should have kept the customized version or the one from the maintainer. I opted to use the maintainers' version to caution against instability.

From what I can tell, when the initramfs was being regenerated against the kernel, it was saying that the zstd package was missing so it defaulted to using gzip.

[xyoming]

I can confirm zstd error.
I've just installed XFCE version, changed to Testing, initiated upgrade and this is what I've got:

Processing triggers for libvlc-bin:amd64 (3.0.17.4-4+b1) ...
Processing triggers for initramfs-tools (0.142) ...
update-initramfs: Generating /boot/initrd.img-5.18.0-3-amd64
W: No zstd in /usr/bin:/sbin:/bin, using gzip
Processing triggers for dbus (1.14.0-2) ...
Processing triggers for libc-bin (2.33-8) ...
Processing triggers for libgdk-pixbuf-2.0-0:amd64 (2.42.8+dfsg-2) ...

I hope this will help

Oh and ofcourse, thank you for this great distro

[geckolinux]

Hi @xyoming thanks for confirming that. zstd will be added to the next release. Meanwhile all current users can install it on their systems.

[geckolinux]

SecureBoot now works out-of-the-box on my hardware with the SpiralLinux 11.220925 release. Success or failure reports would be appreciated.

[CicadaSeventeen]

Secureboot works on my thinkpad

[bliu13]

@geckolinux I just did a reinstall and tested SecureBoot as well. It works on my machine as well.

[geckolinux]

Excellent, thanks @bliu13 and @CicadaSeventeen for confirming that.