-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Boot fails with "vmlinuz has invalid signature" or "bad shim signature, you need to load the kernel first" #543
Comments
I've hit the same issue and I've disabled Secure Boot for now. It's likely due to the bootloader being too old. bootupd should land in the image after the release and will then let people update their bootloader. Or maybe we should include bootupd in Fedora 39 now so that people can update their bootloader before upgrading to Fedora 40. |
Oh Oh. SB39 (stable) just updated (no rebase) to kernel 6.8.4 showing the very same issue.
breaks boot, showing
(Thinkpad T495 using |
And people have to be told what to do. I got a |
Pinging Universal Blue folks as it's likely going to impact them soon: @castrojo @noelmiller @EyeCantCU @KyleGospo |
Unfortunately, now that the kernel has landed in an update, we can not add bootupd to a future F39 build as you won't be able to boot it to get the fix. Overlaying bootupd via So we have coreos/bootupd#635 as an option (that I have not tested yet) to create container images with bootupd based on an older commit with the previous kernel. Or we document how to manually fix this until bootupd finally lands in Atomic Desktops. Unfortunately it will not fully be in Fedora 40 by default yet. See: https://gitlab.com/fedora/ostree/sig/-/issues/1 |
Can't the update to the kernel package be reverted in the same commit that bootupd is added? |
No unfortunately, for Fedora Atomic Desktops, we always take the latest RPMs from the repos. |
@travier I'm watching this one with interest as my Silverblue image is now one week old. If I understand it correctly, the only solution at the moment is to disable Secure Boot? And not even upgrading to Fedora 40 will solve it in the near future? |
The workaround for this issue is going to be commands that do what bootupd does but manually unfortunately. This is mostly doing a copy from I have not tested any of this so I'm not providing ready made commands and everything is at your own risk. Please make backups and make sure that you are confortable rescuing a broken system before trying thing out. Help with testing in VMs or on real hardware is welcomed. I recommend disabling Secure Boot in the meantime until this is fixed. |
Warning: Those instructions should be safe to follow, but still, do at your own risk, make backups Here is the set of commands I've just used to update my (x86_64) EFI booted system successfully:
Once reboot is successful, you can remove the backup copies:
Edit: Updated to add 32bits EFI binaries as well. For aarch64, update the filenames as needed. |
Thanks @travier ! Just did this on my machine and it worked. I was also able to reenable Secure Boot. As a positive side effect, it also looks like the UEFI dbx update was applied. That had been blocked for a while. |
OK sorry yes, this is an embarrassing problem. @travier and I had a chat, a few things here:
Alternatively, we can document how to run bootupd from a privileged container. (In fact, running it from the existing Longer term yes, the technical debt here is high and makes coreos/bootupd#454 important to do and just turn on automatic updates, or at least automatic updates when they're needed. |
@travier I've noticed that the affected Thinkpad T495 was missing Looking into other systems I see the mentioned UPDATE: upgraded two other desktop systems successfully (SB39->SB40 with enabled SecureBoot) using the test steps. |
I tested these steeps on my workstation and my Thinkpad T480. I managed to get secure boot on both devices. On the desktop I had to use fwupdmgr to update the UEFI dbx. |
Has the same issue reported here (also includes a kernel bug report though I am unsure how helpful that is), so, but this question AFAIK remains unanswered:
So does updating fix it? I mean I can boot into an old working Fedora 39 version. Alternatively, if I need to disable Secure Boot temporarily, can I just do so – upgrade to Fedora 40 and boot successfully, afterwards? (Edit: tested, does not work, I can only boot with SecureBoot disabled) Also, would this possibly be a candidate for a common issue if it prevents upgrading to Fedora 40? |
It's a good idea to make it a common issue. It's basically impossible to fix automatically right now for F39 users updating as the new kernel already landed in Fedora 39. We'll try to get bootupd support to a sufficiently good shape to have a small set of commands to enter manually but in the meantime, the commands in #543 (comment) are the best that we have. |
Okay then, I have created a draft for this here: Unfortunately I miss the technical details etc. to properly document it. So feel free to edit it please. |
FYI I can confirm the workaround posted worked:
|
Thereafter, I get the following: After
At second try:
|
@fbruetting seems like a different issue, OSTree updates should not have anything to do with the bootloader update. Maybe ask at the Fedora discussions forum for help? |
This comment was marked as off-topic.
This comment was marked as off-topic.
kernel 6.9 won't boot on system installed prior to F39, as shim is too old. Shim 15.8-3 reached stable on 2023-03-21, so any system using secureboot installed before that won't be able to boot kernel 6.9 See coreos/fedora-coreos-tracker#1752 fedora-silverblue/issue-tracker#543
kernel 6.9 won't boot on system installed prior to F39, as shim is too old. Shim 15.8-3 reached stable on 2023-03-21, so any system using secureboot installed before that won't be able to boot kernel 6.9 See coreos/fedora-coreos-tracker#1752 fedora-silverblue/issue-tracker#543
The 6.9 kernel won't boot on systems installed prior to F39, as the shim is too old. Add a systemd unit that updates the bootloader on those machines. Manually handle systems with mirrored ESPs. See also: coreos/fedora-coreos-tracker#1752 Fixes: fedora-silverblue/issue-tracker#543 Co-authored-by: Jonathan Lebon <[email protected]>
The 6.9 kernel won't boot on systems installed prior to F39, as the shim is too old. Add a systemd unit that updates the bootloader on those machines. Manually handle systems with mirrored ESPs. See also: coreos/fedora-coreos-tracker#1752 Fixes: fedora-silverblue/issue-tracker#543 Co-authored-by: Jonathan Lebon <[email protected]>
For folks interested in helping us with this issue, I've written a draft for an article to be published on the Fedora Magazine: https://fedoramagazine.org/?p=40664&preview=1&_ppp=2f0e5b87ab It includes a "simpler" workaround that would benefit from a little bit more testing. I have also not yet looked at the history to find which versions where impacted first so if folks can find that it would be helpful. Thanks! |
@travier Just tried it on Kinoite (through Ublue), everything worked as expected! Thank you! |
I did some testing this weekend using a VM and the problem seems to be introduced with the 6.9 kernel in Fedora. I found this affects both Fedora Silverblue 39 ( The problematic kernel is introduced in the following versions:
The preview link to the Fed Mag post has expired, but I used the workaround information in this issue successfully. |
Thanks @miabbott and @TimonLukas ! |
Updated preview: https://fedoramagazine.org/?p=40664&preview=1&_ppp=8e94781824 |
@travier if you want to update the article with IoT information, it looks like the |
@travier See https://discussion.fedoraproject.org/t/update-originated-bad-shim-error/124397 Should we include instructions about bringing Kinoite/Silverlbue 39 up-to-date before performing the workaround? |
Ah, that's a good point, we indeed need that :/ |
Hum, but why did this not happen when I tested on F39? I'll test again. |
Do you want to update the preview link? (maybe it is only valid until updated or times out?) |
Updates looks good! Thank you for working on this @travier! |
Ran into this issue trying to upgrade my old laptop on silverblue 39. Read and followed the above preview article, and now I am on 40. Ty |
I’m unable to upgrade to the latest working version mentioned in the article. From a fresh Silverblue 39 installation, updated to 39.20240610.0:
Is there another working version we should be using to test this solution? |
Please don't post the same things in multiple places without linking to it. I've answered in https://discussion.fedoraproject.org/t/talk-boot-fails-with-bad-shim-signature-in-atomic-desktops-and-iot/125412/6. |
This comment was marked as off-topic.
This comment was marked as off-topic.
Is there a script to detect that a kernel image has the old (or wrong)
signing keys, that can present a message to the user indicating that they
need to enroll a SecureBoot new key of that's what it is?
…On Wed, Aug 14, 2024, 6:53 AM JohnnyB ***@***.***> wrote:
I've had this problem for a few kernels since 6.9+ and it seems to me
Fedora is still offering the old shim-x64 package with the old Fedora
secure boot CA. I'm NOT using Silverblue/atomic so the workaround does not
seem applicable.
I see the claim this CA signature is considered old and deprecated, but I
see no other update in F40 or rawhide packaging. Thoughts? I'd rather not
shut off secureboot.
https://discussion.fedoraproject.org/t/after-a-system-update-bad-shim-signature-silverblue-f40/120347/15
~> sudo mokutil --list-enrolled
7e68651d52 Fedora Secure Boot CA
~> sudo dnf info shim-x64
Last metadata expiration check: 0:32:23 ago on Wed 14 Aug 2024 11:18:55 AM BST.
Installed Packages
Name : shim-x64
Version : 15.8
Release : 3
Architecture : x86_64
Size : 3.6 M
Source : shim-15.8-3.src.rpm
Repository : @System
From repo : fedora
Summary : First-stage UEFI bootloader
URL : https://github.com/rhboot/shim/
License : BSD-3-Clause
Description : Initial UEFI bootloader that handles chaining to a trusted full
: bootloader under secure boot environments. This package contains the
: version signed by the UEFI signing service.
—
Reply to this email directly, view it on GitHub
<#543 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAAMNS6EPQQN3LBWKM56N2LZRMZLVAVCNFSM6AAAAABFNNHAT2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEOBYGQZTQOJXGY>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
This comment was marked as off-topic.
This comment was marked as off-topic.
We've landed bootupd in Fedora 41 that should finally prevent those issues in the future. |
Current workaround
See #543 (comment)
Original issue text
Describe the bug
Trying to rebase an existing SB39 to SB40 fails to boot showing
vmlinuz-6.8.1-300.fc40.x86.x64 has invalid signature. you need to load the kernel first
on an Thinkpad T495. I was not able to reproduce the issue on my desktop systems.coming from deployment:
going for:
What I've tried so far
rpm-ostree initramfs --enable
+ rebasecleanup -r
(removing all other deployments) + rebasefedora:fedora/40/x86_64/testing/silverblue
instead, same error except error message points to vmlinuz-6.8.2To Reproduce
rpm-ostree rebase fedora:fedora/40/x86_64/silverblue
systemctl reboot
The text was updated successfully, but these errors were encountered: