The officially official Devuan Forum!

GuillaumeWA

Member

Registered: 2023-12-04

Posts: 10  

Live cd unable to boot with secure boot enabled

Hello,

I'd like to boot from daedalus live on an usb key but it doesn't . I can boot Fedora 39 live, Debian 12 live, MX Linux live.

I can not boot Nitrux live either.

Secure boot is enabled and i can't disable it because i don't have the supervisor password.... i guess that it's the problem

Do you have any clues to help me?

Thank you,

Guillaume

nahkhiirmees

Member

Registered: 2022-07-24

Posts: 261  

Re: Live cd unable to boot with secure boot enabled

I think that booting from usb stick or optical disc is not supposed to work when secureboot is active.

andyp67

Member

Registered: 2022-10-30

Posts: 228  

Re: Live cd unable to boot with secure boot enabled

I have three modern Intel (N3350, J3355,) UEFI BIOS computers.
I am looking at three displays right now, this one I am typing this, and the other two I am playing around with booting.
I have enabled secure boot and booted, both display

----------------------------------
Secure Boot Violation
Invalid signature detected
----------------------------------

I think that if you have managed to boot an OS, secure boot is disabled

rolfie

Member

Registered: 2017-11-25

Posts: 1,217  

Re: Live cd unable to boot with secure boot enabled

Try the netinstall ...

andyp67

Member

Registered: 2022-10-30

Posts: 228  

Re: Live cd unable to boot with secure boot enabled

dd in Linux
and use Rufus in Windows and choose the dd option if offered.

GuillaumeWA

Member

Registered: 2023-12-04

Posts: 10  

Re: Live cd unable to boot with secure boot enabled

I think that booting from usb stick or optical disc is not supposed to work when secureboot is active.

Secure boot is enabled and i can boot Fedora,... from usb, i think there is a missing part on the devuan live usb (a part signed with a Microsoft key)

GuillaumeWA

Member

Registered: 2023-12-04

Posts: 10  

Re: Live cd unable to boot with secure boot enabled

I have three modern Intel (N3350, J3355,) UEFI BIOS computers.
I am looking at three displays right now, this one I am typing this, and the other two I am playing around with booting.
I have enabled secure boot and booted, both display

----------------------------------
Secure Boot Violation
Invalid signature detected
----------------------------------

I think that if you have managed to boot an OS, secure boot is disabled

As i wrote, I can't disable Secure boot because i don't know the supervisor password. Fedora, MX linux and Debian boot from usb (and i installed Fedora and can boot from the ssd too, a message saying Secure Boot is enabled is displayed on the grub screen... but i don't want to use Fedora)

GuillaumeWA

Member

Registered: 2023-12-04

Posts: 10  

Re: Live cd unable to boot with secure boot enabled

Try the netinstall ...

Thank you, I will try to boot the netinstall

GuillaumeWA

Member

Registered: 2023-12-04

Posts: 10  

Re: Live cd unable to boot with secure boot enabled

dd in Linux
and use Rufus in Windows and choose the dd option if offered.

I used dd for the creation of all the installation medias

GuillaumeWA

Member

Registered: 2023-12-04

Posts: 10  

Re: Live cd unable to boot with secure boot enabled

Try the netinstall ...

Thank you, I will try to boot the netinstall

=> It doesn't boot

rolfie

Member

Registered: 2017-11-25

Posts: 1,217  

Re: Live cd unable to boot with secure boot enabled

Too bad, I thought it might work. I do disable Secure Boot on every computer I take my hands on.

fsmithred

Administrator

Registered: 2016-11-25

Posts: 2,527  

Re: Live cd unable to boot with secure boot enabled

If I make a desktop-live iso with signed grub and kernel, will you test it for me? I am unable to test secure boot.
I could have it ready in a day or two and post a link here.

Thanks.

GuillaumeWA

Member

Registered: 2023-12-04

Posts: 10  

Re: Live cd unable to boot with secure boot enabled

If I make a desktop-live iso with signed grub and kernel, will you test it for me? I am unable to test secure boot.
I could have it ready in a day or two and post a link here.

Thanks.

Ok, I will test it, my guess is that you will need the shim package from debian (signed with a Microsoft's key?). I read that Ubuntu manages to boot with only the efi application signed while Fedora uses a chain of trust with everything signed from efi to loaded modules (you can see the status of secure boot on freebsd with thoose details https://wiki.freebsd.org/SecureBoot)

fsmithred

Administrator

Registered: 2016-11-25

Posts: 2,527  

Re: Live cd unable to boot with secure boot enabled

I put the iso on my old website because it was easier to get there from the build host.,
http://distro.ibiblio.org/refracta/file … p-live.iso

sha256sum

4fb0a40a6f58e358e00e940e3ac6c1112ef450dffdcb509bd0df6949041b477c  devuan_daedalus_5.0-signed-test_amd64_desktop-live.iso

GuillaumeWA

Member

Registered: 2023-12-04

Posts: 10  

Re: Live cd unable to boot with secure boot enabled

I put the iso on my old website because it was easier to get there from the build host.,
http://distro.ibiblio.org/refracta/file … p-live.iso

sha256sum

4fb0a40a6f58e358e00e940e3ac6c1112ef450dffdcb509bd0df6949041b477c  devuan_daedalus_5.0-signed-test_amd64_desktop-live.iso

Hello,

I tested it and it doesn't boot, i don't know your recipe, is it an hybrid iso? because my understanding is that my computer must boot in uefi with a signed efi application (with the third party market key from microsoft)

fsmithred

Administrator

Registered: 2016-11-25

Posts: 2,527  

Re: Live cd unable to boot with secure boot enabled

Yes, it's isohybrid. I installed grub-efi-amd64-signed and shim-signed, which pulled in a couple other things. I assume the kernel is signed because there is no kernel package linux-image-*-signed, but there is an -unsigned kernel package. I did not install the -unsigned.

Edit:
When I get to fast internet, I'll download debian-live to compare.

GuillaumeWA

Member

Registered: 2023-12-04

Posts: 10  

Re: Live cd unable to boot with secure boot enabled

Yes, it's isohybrid. I installed grub-efi-amd64-signed and shim-signed, which pulled in a couple other things. I assume the kernel is signed because there is no kernel package linux-image-*-signed, but there is an -unsigned kernel package. I did not install the -unsigned.

Edit:
When I get to fast internet, I'll download debian-live to compare.

Ok, i'll look at it too

GuillaumeWA

Member

Registered: 2023-12-04

Posts: 10  

Re: Live cd unable to boot with secure boot enabled

It seems that your iso image doesn't contain the right efi application : for secure boot with Microsoft signature, i need the efi application from /usr/lib/shim/shimx64.efi.signed (package shim-signed) and a grub efi application signed with the debian signature (package grub-efi-amd64-signed), both in the ESP partition inside the /EFI/boot/ directory

nahkhiirmees

Member

Registered: 2022-07-24

Posts: 261  

Re: Live cd unable to boot with secure boot enabled

After some experiments it became clear to me that when secureboot is on, it verifies the signatures on removable media too. For some reason i thought that when SB is on it just refuses to boot from that kind of media.

GlennW

Member

From: Brisbane, Australia

Registered: 2019-07-18

Posts: 655  

Re: Live cd unable to boot with secure boot enabled

Hi, I noticed on my bios settings when secureboot is switched on another menu becomes available

where I can select forbidden devices like cdrom, usb, wake on lan (or something like that)

maybe you have that setting as well.

Generally I haven't used secureboot since I found a way to turn it off, so I'm no expert.

---

pic from 1993, new guitar day.

Torclyn

Member

From: MoN, Northern Germany

Registered: 2019-06-09

Posts: 8  

Re: Live cd unable to boot with secure boot enabled

I can confirm that neither the Daedalus live ISO nor the netinstall seems to work on a machine with secureboot enabled. If that's of any help, I'll volunteer to test any new images - fsmithreds link above gives me a 404.

---

Everyone has a right to their own opinion, but not their own facts

fsmithred

Administrator

Registered: 2016-11-25

Posts: 2,527  

Re: Live cd unable to boot with secure boot enabled

Thanks for testing. Here's a new live iso. This one has bootx64.efi and shimx64.efi.signed in efi/boot. I made this one using refractasnapshot and had to copy the shim into the iso build tree manually. If it works, I'll work it into live-sdk so it gets into the official isos.

devuan_5_signed-test_amd64-20250110_1825.iso
https://distro.ibiblio.org/refracta/files/experimental/

sha256sum:

ec458d2e023b7d6abc982c8c0f690250c562133a5b0491ced3226602d662903d  devuan_5_signed-test_amd64-20250110_1825.iso

Torclyn

Member

From: MoN, Northern Germany

Registered: 2019-06-09

Posts: 8  

Re: Live cd unable to boot with secure boot enabled

Thanks for the quick reply!

I'm downloading right now and will hopefully get to test it over the weekend.

---

Everyone has a right to their own opinion, but not their own facts

Torclyn

Member

From: MoN, Northern Germany

Registered: 2019-06-09

Posts: 8  

Re: Live cd unable to boot with secure boot enabled

Hi fsmithred,
I got around to some testing at last - sorry for the delay.
Unfortunataly it doesn't seem the image works:
While booting from a USB stick (created with dd) the computer will complain it didn't find a valid signature and not boot at all. When using a Ventoy medium, we get as far as the grub menu, whereafter - no matter which entry has been selected - the following message is displayed:

error: shim_lock protocol not found.
error: you need do load the kernel first.

Tested on two different machines with the same results. Debian boots without trouble on both of them.
Please let me know if there is anything else I can do!

---

Everyone has a right to their own opinion, but not their own facts