Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1299714

Bug#1140760: trixie-pu: package shim-signed/1.51~1+deb13u1

Cross-posted to 2 groups.

Show all headers | View raw

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: shim-signed@packages.debian.org
Control: affects -1 + src:shim-signed
User: release.debian.org@packages.debian.org
Usertags: pu

Hey folks,

As mentioned in #1131861...

We've had new signed shim binaries back from Microsoft for some
time. I've been waiting on the fix for #1137247 (hang/crash
chainloading Windows from grub) in case that might have been shim bug,
but it's now been fixed in grub and we're good.

So, it's time to get a new shim-signed package into trixie. I've
backported the logic from 1.51 in unstable:

  * Add support for verifying and then combining signatures from
    multiple signed shims.
    + Existing sbverify versions in Debian are buggy when verifying.
    + Switch to using a python script verify_combine_sigs to fill in
      the gaps.
  * In preinst, try to verify that the signed shim we're trying to
    install will actually boot on this system - let's not break
    systems on upgrade.

and imported the signed shim binaries which resulted from the trixie
shim update in #1131861.

We need this new signed shim to allowe trixie to install and run on
newer systems which may ship with *only* the new 2023 UEFI CA included
in firmware.

See https://wiki.debian.org/SecureBoot/CAChanges for more background.

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1140760: trixie-pu: package shim-signed/1.51~1+deb13u1 Steve McIntyre <steve@einval.com> - 2026-06-26 01:20 +0200
  Bug#1140760: shim-signed 1.51~1+deb13u1 flagged for acceptance Jonathan Wiltshire <jmw@debian.org> - 2026-06-26 23:00 +0200

csiph-web