Package Details: shim-signed 15.8+ubuntu+1.59-1

Git Clone URL: https://aur.archlinux.org/shim-signed.git (read-only, click to copy)
Package Base: shim-signed
Description: Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments (prebuilt x64 and AA64 binaries from Ubuntu)
Upstream URL: https://packages.ubuntu.com/noble/shim-signed
Keywords: fbx64 mmx64 MokManager SecureBoot shim shimx64 UEFI
Licenses: BSD-2-Clause
Submitter: nl6720
Maintainer: nl6720
Last Packager: nl6720
Votes: 32
Popularity: 0.89
First Submitted: 2016-12-07 12:04 (UTC)
Last Updated: 2024-12-08 10:23 (UTC)

Pinned Comments

nl6720 commented on 2021-05-28 11:19 (UTC)

shim 15.4 requires SBAT. It will not launch EFI binaries without a .sbat section.

nl6720 commented on 2016-12-07 13:17 (UTC) (edited on 2024-12-08 10:29 (UTC) by nl6720)

shimx64.efi is signed with Microsoft key, they also have a hardcoded Ubuntu key inside. MokManager (mmx64.efi) is signed with Ubuntu's key.

shimx64.efi can launch any EFI binary signed with Microsoft keys.

More information is available on the wiki: Secure Boot#shim.

fbx64.efi scan the ESP for CSV files with bootloader information and adds boot entries to the NVRAM. Read README.fallback.

Alternative signed shim sources:

Latest Comments

« First ‹ Previous 1 2 3 4 5 6 Next › Last »

nl6720 commented on 2023-06-27 16:46 (UTC)

There's a Fedora bug for the expired certificate: https://bugzilla.redhat.com/show_bug.cgi?id=2198977

Reading an unrelated bug, it doesn't appear like Fedora (or anyone else?) will release a new signed shim anytime soon.

Jark5455 commented on 2023-06-22 16:40 (UTC) (edited on 2023-06-27 23:14 (UTC) by Jark5455)

I am not sure if this should go here or to fedoras page, but currently when I try to boot the os from the grub menu I receive the error "bad shim signature". Running mokutil --list-enrolled shows that the fedora signature expired on Dec 5 2022.

Edit: This is a grub issue https://bbs.archlinux.org/viewtopic.php?id=286617

nl6720 commented on 2022-11-26 17:11 (UTC)

Please do not flag the package out-of-date if there is no updated Fedora package available.

adrianinsaval commented on 2022-07-05 21:46 (UTC)

How hard would it be to provide a grub-signed package alongside this? The instructions in the wiki to use grub no longer work, it seems it's necessary to use grub-mkimage instead of grub-install but I'm not sure how to do this, for now I just used a copy of fedora's signed grub but it would be better to have a package for this

tom.ty89 commented on 2022-05-31 14:41 (UTC) (edited on 2022-05-31 14:46 (UTC) by tom.ty89)

It seems to me that it's a bad idea to include fbx64.efi in the package, especially when bootx64.csv is not included, since shim will appear to fail with no reason if a user copied fbx64.efi to the ESP as well (by doing something like cp /usr/share/shim-signed/*x64.efi $esp/EFI/BOOT/; ...; mv|cp $esp/EFI/BOOT/{shim,boot}x64.efi).

I suppose it will fail too if shimx64.efi is renamed (instead of copied) to bootx64.efi even if bootx64.csv is included. So it probably is still bad unless it ships also bootx64.efi (a dup of shimx64.efi).

Added a note on the wiki page already though.

nl6720 commented on 2022-05-27 08:24 (UTC)

I added shimia32.efi, mmia32.efi and fbia32.efi to the package. IMHO the files are small enough to not warrant a separate package.

Raansu commented on 2022-05-25 07:26 (UTC)

Would it be possible to add a package for ia32?
I noticed Fedora has a ia32 shim package and I have a HP Pro Tablet 408 G1 that supports secure boot but has a 32 bit UEFI although it has a 64 bit compatible CPU that runs Arch Linux fine.

Bobrolak commented on 2022-01-05 10:50 (UTC)

small update: systemd-boot of systemd 250 is now building with SBAT by default: https://github.com/systemd/systemd/blob/main/NEWS

steadfasterX commented on 2021-11-09 13:44 (UTC)

finally I stumbled over this (SBAT) as well.

I use rEFInd as bootloader and was not able to get it booting anymore after upgrading to this latest shim release.

adding a .sbat entry is easy while it still does not work actually... Main reason: adding a sbat section will not be appended but added to the beginning of the sections - which then let EFI fail.

There is a solution/workaround though.

Check this out: https://github.com/rhboot/shim/issues/376#issuecomment-964137621

« First ‹ Previous 1 2 3 4 5 6 Next › Last »