Post #2176399
2026-04-28 02:29 UTC
I'm impressed. Lenovo released a firmware update for my thinkpad which includes a new microsoft UEFI signing key, but they managed to apply it in such a way that it did not break my secure boot setup using my own keys; my encrypted drive still unlocked with PCR 7 validation.
(seems like with the setup I'm using, the update simply didn't add the new key as a trusted key automatically - if I wanted it added I'd have to do that as an additional manual step)
Replies (1)
-
@kepstin@tenforward.social 2026-04-28 06:37
downside is that i had to sign a copy of the fedora shim in order to be able to install the update with fedora's fwupd. fortunately that doesn't break the security of my automatic disk unlocking, since if something gets booted via shim, shim measures additional keys into pcr 7 which would stop the disk from unlocking. secure boot support on most distros (including fedora) is basically broken by default since they use grub to load an *unsigned* initramfs, meaning that someone with physical access to your system can, without authentication, invisibly rootkit it or use a keylogger to grab your luks password or whatever (without changing the values in any pcrs that have predictable values).