3 ms·

>I recently ran into this trying to boot linux on my old imac. Ubuntu actually works but forget about arch, manjaro, and a whole lot of other distributions. Ima

>I recently ran into this trying to boot linux on my old imac. Ubuntu actually works but forget about arch, manjaro, and a whole lot of other distributions. Imacs have no off-switch for secure boot that I know off. Does it also not let you use your own keys? Because if it does, you don't have to turn SB off, just use your key to sign the UKI and a bootloader like systemd-boot. It should work with any distro, especially one that uses dracut to create the initramfs because it's a couple of lines of dracut config to generate a (signed) UKI instead.

jillesvangurp 4y ago
Not in a way that is obvious to me. I'm sure you can work around it but if you just want to boot a live image and run an installer, ubuntu works and not a whole lot of other distributions do (because their installers don't support secure boot). I assume this is because of how much of a PITA it is to get certified.
- Arnavion 4y ago
  >I assume this is because of how much of a PITA it is to get certified. Distros don't have to do anything distro-specific to get signed. Most distros use (Microsoft-signed) shim to chainload to something like grub. But yes, it might be that the live CDs don't do that; I don't know. My experience with SB on all my machines has been to start with SB disabled and then I enable it afterwards with my own keys. I know the gparted and OpenSUSE live CDs support SB because I've booted off them after enabling SB. You could boot the Ubuntu live CD (or something smaller like gparted), mount the other distro's live CD, chroot into it, and run the other distro's installer that way. Just be sure that you enable SB support so that the installation actually boots afterwards.
  - AshamedCaptain 4y ago
    > Distros don't have to do anything distro-specific to get signed. Most distros use (Microsoft-signed) shim to chainload to something like grub. You still have to get your own version of shim signed if you want your distro to boot "Scary Boot Prompt"-free. I.e. if you just use RedHat's version of shim, that shim will transparently boot RedHat signed kernels, but refuse to boot SuSE's -- unless you whitelist SuSE's key manually into shim. It's not ideal in any way.
    - Arnavion 4y ago
      I believe for OpenSUSE it uses MokManager to get the user to trust the OpenSUSE CA. But it's been a while since I tried it so I might be misremembering. (MokManager is broken on my mobo so I switched to systemd-boot + my own signing keys, which is better for security anyway.)

jillesvangurp 4y ago

Not in a way that is obvious to me. I'm sure you can work around it but if you just want to boot a live image and run an installer, ubuntu works and not a whole lot of other distributions do (because their installers don't support secure boot). I assume this is because of how much of a PITA it is to get certified.

Arnavion 4y ago
>I assume this is because of how much of a PITA it is to get certified. Distros don't have to do anything distro-specific to get signed. Most distros use (Microsoft-signed) shim to chainload to something like grub. But yes, it might be that the live CDs don't do that; I don't know. My experience with SB on all my machines has been to start with SB disabled and then I enable it afterwards with my own keys. I know the gparted and OpenSUSE live CDs support SB because I've booted off them after enabling SB. You could boot the Ubuntu live CD (or something smaller like gparted), mount the other distro's live CD, chroot into it, and run the other distro's installer that way. Just be sure that you enable SB support so that the installation actually boots afterwards.
- AshamedCaptain 4y ago
  > Distros don't have to do anything distro-specific to get signed. Most distros use (Microsoft-signed) shim to chainload to something like grub. You still have to get your own version of shim signed if you want your distro to boot "Scary Boot Prompt"-free. I.e. if you just use RedHat's version of shim, that shim will transparently boot RedHat signed kernels, but refuse to boot SuSE's -- unless you whitelist SuSE's key manually into shim. It's not ideal in any way.
  - Arnavion 4y ago
    I believe for OpenSUSE it uses MokManager to get the user to trust the OpenSUSE CA. But it's been a while since I tried it so I might be misremembering. (MokManager is broken on my mobo so I switched to systemd-boot + my own signing keys, which is better for security anyway.)