Post #2428094

downside is that i had to sign a copy of the fedora shim in order to be able to install the update with fedora's fwupd. fortunately that doesn't break the security of my automatic disk unlocking, since if something gets booted via shim, shim measures additional keys into pcr 7 which would stop the disk from unlocking. secure boot support on most distros (including fedora) is basically broken by default since they use grub to load an *unsigned* initramfs, meaning that someone with physical access to your system can, without authentication, invisibly rootkit it or use a keylogger to grab your luks password or whatever (without changing the values in any pcrs that have predictable values).