Help test initial support for Secure Boot
The Debian Installer team is happy to report that the Buster Alpha 5 release of the installer includes some initial support for UEFI Secure Boot (SB) in Debian's installation media.
This support is not yet complete, and we would like to request some help! Please read on for more context and instructions to help us get better coverage and support.
On amd64 machines, by default the Debian installer will now boot (and
install) a signed version of the shim package as the first stage
boot loader. Shim is the core package in a signed Linux boot chain on
Intel-compatible PCs. It is responsible for validating signatures on
further pieces of the boot process (GRUB and the Linux kernel),
allowing for verification of those pieces. Each of those pieces will
be signed by a Debian production signing key that is baked into the
shim binary itself.
However, for safety during the development phase of Debian's SB support, we have only been using a temporary test key to sign our GRUB and Linux packages. If we made a mistake with key management or trust path verification during this development, this would save us from having to revoke the production key. We plan on switching to the production key soon.
Due to the use of the test key so far, out of the box Debian will not yet install or run with SB enabled; Shim will not validate signatures with the test key and will stop, reporting the problem. This is correct and useful behaviour!
Thus far, Debian users have needed to disable SB before installation to make things work. From now on, with SB still disabled, installation and use should work just the same as previously. Shim simply chain-loads GRUB and continues through the boot chain without checking signatures.
It is possible to enrol more keys on a SB system so that shim will recognise and allow other signatures, and this is how we have been able to test the rest of the boot chain. We now invite more users to give us valuable test coverage on a wider variety of hardware by enrolling our Debian test key and running with SB enabled.
If you want to help us test our Secure Boot support, please follow the instructions in the Debian wiki and provide feedback.
With help from users, we expect to be able to ship fully-working and tested UEFI Secure Boot in an upcoming Debian Installer release and in the main Buster release itself.