Dev1 Galaxy Forum / Devuan and Secure Boot

Re: Devuan and Secure Boot

dummy@example.com (Andre4freedom) — Mon, 05 Apr 2021 10:55:24 +0000

Micronaut, do yourself a favour:
Either leave your system in classic BIOS-mode and your disk in MBR mode, and you will have no negative consequences. (My own experience with a 10 years old HP elitebook pro).
If yours is enough recent, you may re-initialize your laptop, Set BIOS settings to factory defaults, then enable EFI/UEFI-boot, your Intel Virtualisation options to your needs and DISABLE SECURE BOOT (=disable TPM). Then wipe the disk and initialize the disk with a GPT label. When you now install Devuan, it will be in UEFI/EFI mode and it should work.
But if your PC works well in your current setup, there is no harm in using it that way.

Re: Devuan and Secure Boot

dummy@example.com (Micronaut) — Sun, 04 Apr 2021 21:00:15 +0000

The system is an HP 15-f272wm, just about 5 years old. I got it second-hand, didn't actually buy it myself. It's got a 4-core Pentium N3540 CPU and an Atom Z36xxx GPU. I didn't even know it had a GPU until I installed Devuan with Cinnamon and the System Info panel told me. It was originally 4 GB of RAM, but I upgraded it to 8 GB trying to improve the performance of Wind'ohs.

Poking around in the BIOS again, I find there is a setting specifically for secure boot, which I had disabled. But it still wouldn't boot until I enabled legacy support, so I guess I chose MBR when I installed. The menus can be confusing, and I just wanted to get it running something else. Win 10 is a nightmare, spending more time 'updating' itself than I spend actually using the system. And most of the time I had spent using the system was struggling with Win 10 settings and quirks. I also enabled virtualization, which is disabled by default for some reason and I kept seeing error messages about kvm being disabled by BIOS at every boot.

Since everything 'just works' now I am reluctant to re-install just to get the UEFI/GPT. Are there any huge advantages to it? If I need to re-install at some future point, I'll remember to deliberately try GPT.

All I am wondering now is how to get OpenVPN working, so I will post a new thread in the system config forum about that.

Re: Devuan and Secure Boot

dummy@example.com (rolfie) — Sun, 04 Apr 2021 14:06:47 +0000

Beowulf itself is not the issue. I have got 4 mainboards running EFI mode, GPT partitioning and no Secure Boot, 3 of them pure EFI/no CSM. But they are all no laptops.

Give it a try. Maybe we can help.

rolfie

Re: Devuan and Secure Boot

dummy@example.com (Head_on_a_Stick) — Sun, 04 Apr 2021 10:49:39 +0000

Micronaut wrote:

it would not recognize anything but its originally imprinted Win 10 otherwise.

What does that mean, exactly?

Some UEFI firmware implementations are so broken that they will only start Windows' bootmgfw.efi loader. There are workarounds for that though.

Micronaut wrote:

do Debian/Devuan have 'keys' to be allowed to use this 'secure boot' feature?

Yes: https://www.debian.org/releases/stable/ … ecure-boot

Micronaut wrote:

Is it possible to use UEFI/GFT without secure boot?

Yes. EDIT: but some UEFI firmware implementations won't allow it even though it is part of the official specification.

Micronaut wrote:

Would I have to dig further into the BIOS and figure out how to remove the existing keys to allow that?

No.

Devuan and Secure Boot

dummy@example.com (Micronaut) — Sat, 03 Apr 2021 23:16:58 +0000

After literally years of trying to accommodate a Windows 10 install on a second hand laptop, I finally took the plunge and purged the beast, replacing it with Devuan Beowulf. In order to do that, I had to enable 'legacy' booting, as it would not recognize anything but its originally imprinted Win 10 otherwise. So now I've got a system new enough to have UEFI, but still booting from a disk using ancient MBR.

Now I am wondering, as I tweak my new and actually usable laptop, do Debian/Devuan have 'keys' to be allowed to use this 'secure boot' feature? Or does it have to always be disabled to install Linux on a system that has it? Is it possible to use UEFI/GFT without secure boot? Would I have to dig further into the BIOS and figure out how to remove the existing keys to allow that?