Arch Linux User Repository

shim 15.4 requires SBAT. It will not launch EFI binaries without a .sbat section.

shimx64.efi is signed with Microsoft key, they also have a hardcoded Ubuntu key inside. MokManager (mmx64.efi) is signed with Ubuntu's key.

shimx64.efi can launch any EFI binary signed with Microsoft keys.

More information is available on the wiki: Secure Boot#shim.

fbx64.efi scan the ESP for CSV files with bootloader information and adds boot entries to the NVRAM. Read README.fallback.

Alternative signed shim sources:

• Debian shim: https://tracker.debian.org/pkg/shim-signed
• Fedora shim: https://koji.fedoraproject.org/koji/packageinfo?packageID=14502

@philch Have you tried to re-install grub? not the package, but the booloader with grub-install .... With the latest grub package installed, of course.

I think I saw a warning about resintalling with a recent grub update (of the package)

Note: I don't use grub as bootloader

Edit: Also, looking at the install file of grub, on can see:

  Grub does no longer support side-loading modules when secure boot is
    enabled. Thus booting will fail, unless you have an efi executable
    'grubx64.efi' with bundled modules

Sorry, I have no idea about GRUB. All I've read about using Secure Boot + GRUB is that it is a pain.

This release 15.8+ubuntu+1.57-1 is not working on my aptop. Get below error on boot up and PC shuts down:

Verifying shim SBAT: Security Violation Failure Something went terribly wrong [...]

Restoring to earlier version 15.7+ubuntu+1.56-1 and tried re-install and checked the sbat revocation:

sudo mokutil --list-sbat-revocations

sbat,1,2023012900

shim,2

grub,3

grub.debian,4

My current sbat file is as follows:

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md

grub,3,Free Software Foundation,grub,2:2.12-2,https//www.gnu.org/software/grub/

grub.arch,1,Arch Linux,grub,2:2.12-2,https://archlinux.org/packages/core/x86_64/grub/

Please advice.

There is something weird. The deb package is gone. The package can't be built anymore.

OK. That's one way to dodge the question.

Also, I am wondering why we need to have all the binaries of the arch installed; because only ne will be used, right? Like x86_64 and never any aarch64 efi binaries...

and if you add, later on, the 32bit binaries

The EFI binaries are not run in Linux, so I don't see an issue with using arch=('any').

The package does not follow the PKGBUILD man page and recommended guidelines.

You are supposed to use an arch=('any') if the pacakge contains no architecture specific files. This is not true here because it contains binaries for either x86_64 or aarch64.

You can make a proper multi-arch PKGBUILD i.e. that builds either a x86_64 package or an aarch64 one with this patch applied:

--- PKGBUILD    2024-03-21 19:19:03.227604132 +0100
+++ PKGBUILD.new    2024-03-21 19:17:58.894824873 +0100
@@ -3,34 +3,33 @@
 pkgname='shim-signed'
 pkgver='15.8+ubuntu+1.57'
 pkgrel='1'
-pkgdesc='Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments (prebuilt x64 and AA64 binaries from Ubuntu)'
+pkgdesc='Secure Boot chain-loading bootloader (Microsoft-signed binary from Ubuntu)'
 url='https://packages.ubuntu.com/noble/shim-signed'
-arch=('any')
+arch=('x86_64' 'aarch64')
 license=('BSD-2-Clause')
 options=('!strip' '!debug')
 install="${pkgname}.install"
-source=("http://archive.ubuntu.com/ubuntu/pool/main/s/shim-signed/shim-signed_${pkgver##*+ubuntu+}+${pkgver%%+ubuntu*}-0ubuntu1_amd64.deb"
-        "http://ports.ubuntu.com/pool/main/s/shim-signed/shim-signed_${pkgver##*+ubuntu+}+${pkgver%%+ubuntu*}-0ubuntu1_arm64.deb")
-noextract=("shim-signed_${pkgver##*+ubuntu+}+${pkgver%%+ubuntu*}-0ubuntu1_arm64.deb")
-sha256sums=('532a97f7376ac8e5d7bedb8b2d4283769251266d19a78e3e12ec44f53a1dab6a'
-            '5f942542c21c41ffa14d22b890a6f51ccbfa0b3231f8a475265f90cb6e1cb924')
-sha512sums=('de1c60b442d7484aa210c308ca422fe0d93439b50aeba192d2bbec7ec4d92779355d6ca838bb3d221fad8c4ea343dae37c13606200daf6f8f1436b120a4e9690'
-            'ed0c856460c5a2aef8d9c4214ee9f2ba0c4926c4efec8add7171c0adada68f6c87f43461d67f8ca8747e9eaa037b2b90810d8daebecbc1c3a67bea34f781ea3e')
+source_x86_64=("http://archive.ubuntu.com/ubuntu/pool/main/s/shim-signed/shim-signed_${pkgver##*+ubuntu+}+${pkgver%%+ubuntu*}-0ubuntu1_amd64.deb")
+source_aarch64=("http://ports.ubuntu.com/pool/main/s/shim-signed/shim-signed_${pkgver##*+ubuntu+}+${pkgver%%+ubuntu*}-0ubuntu1_arm64.deb")
+sha256sums_x86_64=('532a97f7376ac8e5d7bedb8b2d4283769251266d19a78e3e12ec44f53a1dab6a')
+sha256sums_aarch64=('5f942542c21c41ffa14d22b890a6f51ccbfa0b3231f8a475265f90cb6e1cb924')
+sha512sums_x86_64=('de1c60b442d7484aa210c308ca422fe0d93439b50aeba192d2bbec7ec4d92779355d6ca838bb3d221fad8c4ea343dae37c13606200daf6f8f1436b120a4e9690')
+sha512sums_aarch64=('ed0c856460c5a2aef8d9c4214ee9f2ba0c4926c4efec8add7171c0adada68f6c87f43461d67f8ca8747e9eaa037b2b90810d8daebecbc1c3a67bea34f781ea3e')

 prepare() {
    local debfile

    cd "$srcdir"
    bsdtar -xf data.tar.xz
-   for debfile in ${noextract[@]}; do
-       bsdtar -xOf "$debfile" data.tar.xz | bsdtar -x usr/lib/shim/
-   done
 }

-
 package() {
-   install -Dm0644 "${srcdir}/usr/lib/shim/shimx64.efi.signed.latest" "${pkgdir}/usr/share/${pkgname}/shimx64.efi"
-   install -Dm0644 "${srcdir}/usr/lib/shim/shimaa64.efi.signed.latest" "${pkgdir}/usr/share/${pkgname}/shimaa64.efi"
-   install -Dm0644 "${srcdir}/usr/lib/shim/"{mm,fb}{x64,aa64}".efi" "${pkgdir}/usr/share/${pkgname}/"
+   if [ $CARCH == "x86_64" ] ;then
+       install -Dm0644 "${srcdir}/usr/lib/shim/shimx64.efi.signed.latest" "${pkgdir}/usr/share/${pkgname}/shimx64.efi"
+       install -Dm0644 "${srcdir}/usr/lib/shim/"{mm,fb}x64".efi" "${pkgdir}/usr/share/${pkgname}/"
+   elif [ "$CARCH" == "aarch64" ] ;then
+       install -Dm0644 "${srcdir}/usr/lib/shim/shimaa64.efi.signed.latest" "${pkgdir}/usr/share/${pkgname}/shimaa64.efi"
+       install -Dm0644 "${srcdir}/usr/lib/shim/"{mm,fb}aa64".efi" "${pkgdir}/usr/share/${pkgname}/"
+   fi
    install -Dm0644 "${srcdir}/usr/share/doc/shim-signed/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }

The pkgdesc is also quite long and could be shorter than 100 characters.

For 15.8, it looks like going with Fedora's shim-15.8-3 is not a good idea. shimia32.efi and shimaa64.efi are unsigned while other aa64 binaries are signed by "Red Hat Test Certifying CA"?! Only x64 binaries look ok.

Apparently Fedora now updated it's certificate in their shim package, according to previously mentioned bug report: https://bugzilla.redhat.com/show_bug.cgi?id=2198977 It is also a newer version (15.8)

Using Debian's shim would require adding an epoch to the PKGBUILD. :(

If anyone wants to try, here's an untested diff (without the epoch):

diff --git a/PKGBUILD b/PKGBUILD
index e7fa104647005d6d752191f627ea13da9168cb1b..fdac313830baef1be4a7dab0482e89e3be93339a 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,25 +1,50 @@
 # Maintainer: nl6720 <nl6720@archlinux.org>

 pkgname='shim-signed'
-pkgver='15.7+ubuntu+1.56'
+pkgver='15.7+debian+1.40'
 pkgrel='1'
-pkgdesc='Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments (prebuilt x64 binaries from Ubuntu)'
-url='https://packages.ubuntu.com/noble/shim-signed'
+pkgdesc='Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments (prebuilt x64, IA32 and AA64 binaries from Debian)'
+url='https://tracker.debian.org/pkg/shim-signed'
 arch=('any')
 license=('BSD')
 options=('!strip')
 install="${pkgname}.install"
-source=("http://archive.ubuntu.com/ubuntu/pool/main/s/shim-signed/shim-signed_${pkgver##*+ubuntu+}+${pkgver%%+ubuntu*}-0ubuntu1_amd64.deb")
-sha256sums=('b2d84b300e68ac2139afee3f9a609857ef80f12eed9218087ced4b31ecb7fd76')
-sha512sums=('43ee11ec0ed04f224fb7452b2baaca45882a719063879f423c4118b6b99e99fd3fb20fa1a7de02af7b885f4d5c5e86e9868fb41557e74c52fbf04e3988199bd6')
+source=("http://deb.debian.org/debian/pool/main/s/shim-signed/shim-signed_${pkgver##*+debian+}.tar.xz"
+        "http://ftp.debian.org/debian/pool/main/s/shim-helpers-amd64-signed/shim-helpers-amd64-signed_1+${pkgver%%+debian+*}+1_amd64.deb"
+        "http://ftp.debian.org/debian/pool/main/s/shim-helpers-i386-signed/shim-helpers-i386-signed_1+${pkgver%%+debian+*}+1_i386.deb"
+        "http://ftp.debian.org/debian/pool/main/s/shim-helpers-arm64-signed/shim-helpers-arm64-signed_1+${pkgver%%+debian+*}+1_arm64.deb")
+noextract=("shim-helpers-amd64-signed_1+${pkgver%%+debian+*}+1_amd64.deb"
+           "shim-helpers-i386-signed_1+${pkgver%%+debian+*}+1_i386.deb"
+           "shim-helpers-arm64-signed_1+${pkgver%%+debian+*}+1_arm64.deb")
+md5sums=('1dcbbb922e650db660c773227cbe9eeb'
+         '5fc737504651ec2d22cd0e425546b6b1'
+         'a2b4ddc85455662c76f59ba6487c13ef'
+         '0fb529c47fcc7cca9c675a771a4717cd')
+sha256sums=('4b2672a177acc5a7e1a8a1d88e118d07918dce51aa60ae26a99edce4f48e9ca5'
+            '81218cec1bacf045a30c8215e92c433b53bc51f9be9010baba4ffd71093437f3'
+            'd22b5b9db03ce3e52404dc4afa2a61398bfe4e3b18d292ae8f2461c2176fa9e0'
+            '84374882eccc15a10418fbc31d15f7f74cc9619089847d4d145ba562281e02dd')
+sha512sums=('f3eab6fbb65cd55b894917f8b09abd4ed326a96f6d8d14793c79a4a5586797c82671e9023043227a586c444ba8a83ec412370965e43ca165b5a2f900890a9e99'
+            'e0e075d746b24b240042d59a0f0db2155d3f1f1ff729d63a12b2852a1b54ee1e557f00d8f80a3f075e4786c1e6e752748d266a20fce0c9bd1f2bef47697e2e01'
+            '88ade890592e3725f42e220925a2c9485df6625f3af311d9c2c2ae58c7c6d37cc8efe051dcf87e6ecf8f083422cfeeb2e1c76045ded67f87b053bddc151f9028'
+            'a03f88589455b4b61489107ef7f64adb4099772fade3632376668e392018be79089a064de2c57fd0bad0dafc73c25a10c7ed5608dc36c25194290d0b188d872a')

 prepare() {
+   local debfile
+
    cd "$srcdir"
-   bsdtar -xf data.tar.xz
+   for debfile in ${noextract[@]}; do
+       bsdtar -xOf "$debfile" data.tar.xz | bsdtar -x usr/lib/shim/
+   done
 }

 package() {
-   install -Dm0644 "${srcdir}/usr/lib/shim/shimx64.efi.signed.latest" "${pkgdir}/usr/share/${pkgname}/shimx64.efi"
-   install -Dm0644 "${srcdir}/usr/lib/shim/"{mm,fb}x64.efi "${pkgdir}/usr/share/${pkgname}/"
-   install -Dm0644 "${srcdir}/usr/share/doc/shim-signed/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+   local uefiarch
+
+   for uefiarch in x64 ia32 aa64; do
+       install -Dm0644 "${srcdir}/shim-signed.git/shim${uefiarch}.efi.signed" "${pkgdir}/usr/share/${pkgname}/shim${uefiarch}.efi"
+       install -Dm0644 "${srcdir}/usr/lib/shim/mm${uefiarch}.efi.signed" "${pkgdir}/usr/share/${pkgname}/mm${uefiarch}.efi"
+       install -Dm0644 "${srcdir}/usr/lib/shim/fb${uefiarch}.efi.signed" "${pkgdir}/usr/share/${pkgname}/fb${uefiarch}.efi"
+   done
+   install -Dm0644 "${srcdir}/shim-signed.git/debian/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }