A new key was issued in 2023, but it might not be well-supported ahead of the original key's expiration.

Linux users may face yet another hurdle related to Secure Boot when the Microsoft-signed key used by many distributions to support the firmware-based security feature expires on September 11, leaving users at the mercy of distribution from OEMs, and systems possibly not receiving a necessary firmware update.

As LWN reported (paywall) that Microsoft will stop using the expiring key to sign the shim in September. “But the replacement key, which has been available since 2023, may not be installed on many systems; worse yet, it may require the hardware vendor to issue an update for the system firmware, which may or may not happen,” LWN said. “It seems that the vast majority of systems will not be lost in the shuffle, but it may require extra work from distributors and users.”

The report said manufacturers could add support for the new key in a full firmware update or by updating the KEK database. The former assumes that manufacturers would be interested in distributing a firmware update for a wide variety of products so a small percentage of their users could use Secure Boot with a non-Windows OS; the latter is an unproven mechanism that isn’t guaranteed to work on all devices. Both seem likely to leave at least some people to figure out a solution on their own.

    • Ben@feddit.dk
      34·
      3 days ago

      Tools to do that exists. fwupd is a tool to update firmwares. I just tested it on a thinkpad and went from 351 keys to 518 secureboot keys.

      GNOME Software also uses fwupd, that should take care of a good chunk of users.

      • kadu@lemmy.world
        182·
        3 days ago

        So this is an exaggerated non-issue that is phrased as if it was the end of Linux? Crazy, this never happened before! See you all next week when Linux is doomed again.

        • groet@feddit.org
          215·
          3 days ago

          Its an exaggerated non-issue

          Linux is not a uniform userbase. Many systems will be affected by this. Many users will be fine because they use a well used and maintained distro. Many servers and embedded systems will not be fine.

          That raspi running your pihole that is never updated? Yeah that might just stop booting next time there is a poweroutage and you wouldn’t know what’s up.

          • kadu@lemmy.world
            214·
            3 days ago

            What Raspberry Pi is booting with SecureBoot and default keys? Give me a break.

      • progandy@feddit.org
        3·
        2 days ago

        There are still vendors that do not provide firmware with this tool or only for select devices.

    • fubarx@lemmy.world
      5·
      2 days ago

      The Windows update loads a chain of trust that tells the bootloader the device is OK and your version of Windows is real and your full-disk-encryption is fine. Linux folks don’t have (or need) all that. They can create their own chain of trust if they want, but they don’t have read/write access to the Microsoft one.

      If they did, we would be reading a completely different article starting with why the world was on fire.