From 642c8d6cda257846db44f1b1e18fc84194a6a978 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Wed, 28 Oct 2026 22:02:56 +0100 Subject: secure-boot: T9496: document Secure Boot signature check on "add system image" With Secure Boot enabled, "add system image" now aborts if the Linux Kernel of the new image is not signed by an enrolled Machine Owner Key, since that image would not boot. Describe the check, its error message and when it is skipped, and point to it from the image update page. --- docs/installation/update.md | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'docs/installation/update.md') diff --git a/docs/installation/update.md b/docs/installation/update.md index cdc8b20d..6bcaa134 100644 --- a/docs/installation/update.md +++ b/docs/installation/update.md @@ -30,6 +30,13 @@ For example: /tmp/vyos-1.2.3-amd64.iso. If there isn't enough free disk space, the installation will be canceled. To delete images, use the {opcmd}`delete system image` command. +:::{note} +If the running system has UEFI Secure Boot enabled, the Linux Kernel of the +new image must be signed by an enrolled Machine Owner Key. Otherwise the +installation is canceled, because the new image would not boot. See +{ref}`secure-boot` for details. +::: + VyOS associates configuration with each image, and each image has its own unique configuration copy. This differs from traditional network routers where -- cgit v1.2.3