search

kairos-io / kairos

The immutable Linux meta-distribution for edge Kubernetes.
https://kairos.io
Apache License 2.0
1.16k stars 96 forks source link

Fix secure boot #3018

Closed jimmykarily closed 1 week ago

jimmykarily commented 1 week ago

SInce we started embedding grub artifacts in auroraboot (https://github.com/kairos-io/AuroraBoot/pull/102/files#diff-36043890c52c8201a8bc84238c219be45ce07bf172d89f693c7c54ffe70d046eR33), we no longer get the one from the distro so the OS and the shim are signed by 2 different keys. This may have broke secure boot in images built with latest auroraboot.

Let's look into it and if this is the case, we should not embed such artifacts but rather install the distro ones in the base images.

Itxaka commented 1 week ago

I was mistaken, the file we are bundling is the hybryd_boot.img which refers to booting under BIOS not under EFI.

For EFI we still use the grub.efi provided by the base image.