this post was submitted on 20 Jul 2025
133 points (99.3% liked)

Linux

56905 readers
644 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 6 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
133
Linux and Secure Boot certificate expiration (lwn.net)
submitted 1 week ago by HaraldvonBlauzahn@feddit.org to c/linux@lemmy.ml
51 comments fedilink hide all child comments
 

Linux users who have Secure Boot enabled on their systems knowingly or unknowingly rely on a key from Microsoft that is set to expire in September. After that point, Microsoft will no longer use that key to sign the shim first-stage UEFI bootloader that is used by Linux distributions to boot the kernel with Secure Boot. But the replacement key, which has been available since 2023, may not be installed on many systems; worse yet, it may require the hardware vendor to issue an update for the system firmware, which may or may not happen. It seems that the vast majority of systems will not be lost in the shuffle, but it may require extra work from distributors and users.

you are viewing a single comment's thread
view the rest of the comments
[–] exu@feditown.com 15 points 1 week ago (2 children)

I don't think you understand what "enrolling your own keys" means in the context of Secure Boot.

The key affected here is specifically for the Linux shim signed by Microsoft. It is used by GRUB and some distros to work with Secure Boot.

Enrolling your own key means you add a new certificate to the key store. This is completely separate from the one provided by Microsoft and controlled only by you. The common recommendation is to remove all built-in keys and only add your own, to make this system as secure as possible.

[–] HaraldvonBlauzahn@feddit.org 0 points 1 week ago* (last edited 1 week ago) (1 children)

OK, now you are talking about something a bit different - registering own keys in the UEFI system, which is significantly more involved than updating the BIOS, and also requires firmware support, and the firmware also needs to match the motherboard. And the whole issue with ACPI support for Linux shows clearly that having reams of specufications is not enough, the implementation of the BIOS needs to match that specification which whether thsz's the case you will only learn after you bought the hardware.

Here is a description of that process:

https://docs.bell-sw.com/alpaquita-linux/latest/how-to/use-own-keys-in-secureboot/

Moreover, for any change of the boot chain, bootloader, posdibly also kernel, this needs to be repeated.

Do you think that's accessible to normal users? Considering most have probably not even ever done a firmware update?

[–] exu@feditown.com 4 points 1 week ago

From the first post in this chain

That said, I've always just enrolled my own keys. I know some other distros that make you enroll their keys as well like Bazzite. At least that way you don't depend on Microsoft's keys and shim or anything, clean proper secure boot straight into UKI.

I didn't start talking about it, this was many comments above

[–] HaraldvonBlauzahn@feddit.org -4 points 1 week ago

The key affected here is specifically for the Linux shim signed by Microsoft.

And exactly that Linux shim signed by Microsoft is no longer valid because the Microsoft signature in the UEFI firmware is expired.