diff options
| author | Luca Boccassi <bluca@debian.org> | 2018-02-27 19:28:33 +0000 |
|---|---|---|
| committer | Luca Boccassi <bluca@debian.org> | 2018-03-09 20:57:54 +0000 |
| commit | 035518ff69a97fa5d3fa432e13c9593a9f459a4e (patch) | |
| tree | 98d07bcaf0927518c0a3a78b87893a6c6955bf71 /functions | |
| parent | ac3ed23638cbc4b10059f9678283d08b4a082136 (diff) | |
| download | vyos-live-build-035518ff69a97fa5d3fa432e13c9593a9f459a4e.tar.gz vyos-live-build-035518ff69a97fa5d3fa432e13c9593a9f459a4e.zip | |
UEFI: add support for Secure Boot on amd64 and arm64
Support for UEFI Secure Boot is modelled after how it currently works
in Ubuntu and on how it is going to work on Debian.
A minimal bootloader, shim, is used as the first-stage and it then
loads grub. Both have to be signed.
shim-signed is already available in Debian so the filenames are
already established, and the grub2 repository and packaging is common
between the 2 distros so we can already be reasonably sure of what it
is going to be.
So if both are available, copy /usr/lib/shim/shim[x64|aa64].efi.signed
as boot[x64|aa64].efi so that UEFI loads it first, and copy
/usr/lib/grub/[x86_64|arm64]-efi-signed/grub[x64|aa64].efi.signed as
grub[x64|aa64].efi.
This grub2 EFI monolithic image is currently hard-coded in grub2's
repository to look for a config file in efi/debian, so make a copy
of the previously added minimal grub.cfg that loads the real one in
that directory in both the fat32 and ISO 9660 partitions.
The new option --uefi-secure-boot can be set to auto (default,
enable or disable.
In auto, the lack of the signed EFI binaries is intentionally left as a
soft failure - live-build will simply fallback to using the locally
generated non-signed grub2 monolithic EFI binary as the only
bootloader. Given the difficulties surrounding the Secure Boot
signing infrastructure this approach gives the most flexibility and
makes sure things will "just work" once the packages are available,
without the need to change anything in the configuration.
This will also greatly help downstream distributions and users who
want to do self-signing.
The enable or disable options work as expected.
Closes: #821084
Diffstat (limited to 'functions')
| -rwxr-xr-x | functions/defaults.sh | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/functions/defaults.sh b/functions/defaults.sh index 78ca358d1..2ba7d475f 100755 --- a/functions/defaults.sh +++ b/functions/defaults.sh @@ -770,6 +770,9 @@ Set_defaults () # Setting swap file LB_SWAP_FILE_SIZE="${LB_SWAP_FILE_SIZE:-512}" + # Setting UEFI Secure Boot + LB_UEFI_SECURE_BOOT="${LB_UEFI_SECURE_BOOT:-auto}" + ## config/source # Setting source option |