Nice job. Glad your motherboard accepted the key that way. Mine didn't when I switched to that file.

Nice job. Glad your motherboard accepted the key that way. Mine didn't when I switched to that file. I did practically the same thing, but the MokUtil enrollment GUI was basically pretending to enroll the key but didn't write anything to BIOS memory. I just assumed that there was an untrusted code path/write lock involved, and stopped trying. This definitely varies between different BIOSes though.

So your machine is secureboot enrolled now?

ArcitecOP•5/14/23, 1:19 AM

Btw there's a new exploit out that may make your BIOS unable to use secure boot again, if it only trusts the old Microsoft key. I remember hearing that Microsoft will change the signing key used for both Windows and the Linux SB shim because of some huge exploit.

Edit:
https://arstechnica.com/information-technology/2023/05/microsoft-patches-secure-boot-flaw-but-wont-enable-fix-by-default-until-early-2024/

ArcitecOP•5/14/23, 1:24 AM

Okay a comment on the article clarified it better: Microsoft will revoke their old SecureBoot master key to prevent booting from old, vulnerable bootloaders signed with the old key.

ArcitecOP•5/14/23, 1:25 AM

The bug was in their Windows bootloader itself, but to protect people they need to block the old key itself with a BIOS update to revoke the key's trust. Linux will be getting the same patch because the SB shim will be signed with the new key instead. I remember seeing that MS is already in contact with the Fedora team about this.

ArcitecOP•5/14/23, 1:26 AM

Let's hope they use some kind of derived key system so that your current Microsoft root certificate in the BIOS can still authenticate their upcoming, new key

AArcitec Nice job. Glad your motherboard accepted the key that way. Mine didn't when I sw...

ragectl•5/14/23, 1:26 AM

Yeah the secure boot is enabled and nvidia modules are loaded. I can see in rpm-ostree that it's on the ublue silverblue nvidia image

Rragectl Yeah the secure boot is enabled and nvidia modules are loaded. I can see in rpm-...

ArcitecOP•5/14/23, 1:27 AM

That's really nice news. Sounds like you remembered to run the command to set the kernel boot args too?

ragectl•5/14/23, 1:27 AM

One question though, my silverblue-nvidia install hasn't prompted me to run any tools like Yafti and the Firefox isn't via Flatpak. Is that something not included in the ISO?

ArcitecOP•5/14/23, 1:27 AM

Yeah yafti is a tool for your own downstream images created from the template in the

ublue-os/startingpoint

ublue-os/startingpoint

repo. It isn't even installed in the main or nvidia images.

Main and Nvidia images are very close to upstream silverblue, with some conveniences like RPM fusion, codecs etc installed.

AArcitec That's really nice news. Sounds like you remembered to run the command to set th...

ragectl•5/14/23, 1:28 AM

I haven't run any specific commands for kernel arguements, no

ArcitecOP•5/14/23, 1:28 AM

Oh okay you need to do that, ostree has a special security model where kernel boot args can only be set by you, the admin. It's listed here: https://ublue.it/images/nvidia/

ragectl•5/14/23, 1:32 AM

Do the installer ISO not do that automatically? https://github.com/ublue-os/main/releases

GitHub

Releases · ublue-os/main

An OCI base image of Fedora with batteries included - ublue-os/main

ragectl•5/14/23, 1:32 AM

I will have a look

ragectl•5/14/23, 1:32 AM

that install ISO is three weeks old, so maybe missing some changes?

ArcitecOP•5/14/23, 1:34 AM

That iso pulls the latest image from the internet during install, so the ISO is meant to only be updated rarely.

And no the iso doesn't seem to set kargs, I cannot find the word

kargs

kargs

anywhere in the source code of those repos.

ragectl•5/14/23, 1:34 AM

Well the kernel args have been set in /etc/default/grub and I didn't add them

ragectl•5/14/23, 1:34 AM

the rpmfusion modules do usually update those

ArcitecOP•5/14/23, 1:35 AM

It won't on silverblue: https://rpmfusion.org/Howto/NVIDIA#OSTree_.28Silverblue.2FKinoite.2Fetc.29

ArcitecOP•5/14/23, 1:35 AM

I don't even think that /etc/default/grub's kernel args are used at all on silverblue
Edit: They're not used.

ragectl•5/14/23, 1:46 AM

and of course the Acer bios updater for this old laptop requires Windows because it's a .exe file

Rragectl and of course the Acer bios updater for this old laptop requires Windows because...

ArcitecOP•5/14/23, 1:49 AM

Hmm try opening it with 7zip and seeing if you can get the files from inside. It's usually some DOS exe and a firmware blob inside "windows BIOS updaters".

AArcitec I don't even think that /etc/default/grub's kernel args are used at all on silve...

ragectl•5/14/23, 1:49 AM

OK well something is doing something because the /boot/grub2/grub.cfg linked to /boot/loader/grub.cfg has the same kernel options added

Rragectl OK well something is doing something because the /boot/grub2/grub.cfg linked to ...

ArcitecOP•5/14/23, 1:50 AM

Run

cat /proc/cmdline

cat /proc/cmdline

and look for those flags to be sure

AArcitec Hmm try opening it with 7zip and seeing if you can get the files from inside. It...

ragectl•5/14/23, 1:59 AM

there are some other exe files inside the installer, but how would I use those in Linux?

Rragectl there are some other exe files inside the installer, but how would I use those i...

ArcitecOP•5/14/23, 1:59 AM

With a FreeDOS USB boot stick, boot into the DOS environment and run the exe.

AArcitec Run `cat /proc/cmdline` and look for those flags to be sure

ragectl•5/14/23, 2:00 AM

this contains the same args as the /etc/default/grub and /boot/grub2/grub.cfg file

Rragectl this contains the same args as the /etc/default/grub and /boot/grub2/grub.cfg fi...

ArcitecOP•5/14/23, 2:00 AM

That must mean that when the modules are bundled instead of layered, they become part of the actual boot args, unlike when they are manually layered with

rpm-ostree install

rpm-ostree install

, where you need to run

rpm-ostree kargs

rpm-ostree kargs

manually.

ArcitecOP•5/14/23, 2:02 AM

No... that theory makes no sense. Because if you install regular Silverblue and rebase to the

nvidia

nvidia

image, you likewise have the nvidia modules bundled instead of layered, and you don't get the same luxury there and need to manually run the

kargs

kargs

command...

ArcitecOP•5/14/23, 2:03 AM

It seems like the Nvidia ISO is an exception to this rule.

ragectl•5/14/23, 2:03 AM

Ahh FreeDOS I don't think I've ever used it. Might give it a go later

ArcitecOP•5/14/23, 2:04 AM

It's pretty painless, unless the

.exe

.exe

you found requires some undocumented arguments.

ragectl•5/14/23, 2:05 AM

@Arcitec before I ran the uBlue ISO install the laptop had vanilla Silverblue. I haven't set any manual commands, I just ran the installer. Apart from fixing my ancient bios errors, it's all automated

Rragectl @Arcitec before I ran the uBlue ISO install the laptop had vanilla Silverblue. I...

ArcitecOP•5/14/23, 2:06 AM

Yea it just surprises me greatly because the ublue repos and ublue isogenerator don't contain the words

kargs

kargs

cmdline

cmdline

anywhere.

ragectl•5/14/23, 2:07 AM

did you try a search for modeset?

Rragectl did you try a search for modeset?

ArcitecOP•5/14/23, 2:08 AM

Bingo:

os-isogenerator/installer/kickstart/ublue-os-nvidia.ks
7:bootloader --append="rd.driver.blacklist=nouveau modprobe.blacklist=nouveau nvidia-drm.modeset=1"

os-isogenerator/installer/kickstart/ublue-os-nvidia.ks
7:bootloader --append="rd.driver.blacklist=nouveau modprobe.blacklist=nouveau nvidia-drm.modeset=1"

ArcitecOP•5/14/23, 2:08 AM

It's part of the Fedora kickstart installer script used by the NVIDIA ISO!

ArcitecOP•5/14/23, 2:08 AM

So this is the one and only scenario where the command doesn't have to be executed manually.

ragectl•5/14/23, 2:10 AM

https://github.com/ublue-os/nvidia/blob/main/justfile

GitHub

nvidia/justfile at main · ublue-os/nvidia

Fedora variants with built-in Nvidia drivers. Contribute to ublue-os/nvidia development by creating an account on GitHub.

ragectl•5/14/23, 2:11 AM

set-kargs:
rpm-ostree kargs \
--append=rd.driver.blacklist=nouveau \
--append=modprobe.blacklist=nouveau \
--append=nvidia-drm.modeset=1

ArcitecOP•5/14/23, 2:11 AM

Yeah that's a different file, that's for the

just set-kargs

just set-kargs

command which runs the command I mentioned, it's a manual thing you do after install.

ArcitecOP•5/14/23, 2:11 AM

The file responsible for the ISO settings is here:

https://github.com/ublue-os/isogenerator/blob/main/installer/kickstart/ublue-os-nvidia.ks#L7

ArcitecOP•5/14/23, 2:12 AM

I don't know how permanent that is. It tells Kickstart to install Fedora with that as its current boot arguments. Will it persist after future kernel upgrades, when the grub config is re-generated from a new ostree commit? That remains to be seen.

ArcitecOP•5/14/23, 2:13 AM

You have to realize that there's so much trouble with getting kernel args into OSTree distros. It's not as simple as editing /etc/grub stuff.

ragectl•5/14/23, 2:14 AM

that's the point of having the /etc/default/grub file with those settings because that's what Grubby etc in Fedora should be using to get kernel args

Rragectl that's the point of having the /etc/default/grub file with those settings becaus...

ArcitecOP•5/14/23, 2:14 AM

But it won't. See: https://github.com/coreos/rpm-ostree/issues/3738

ArcitecOP•5/14/23, 2:14 AM

OSTree is a totally different way to boot a distro. It's what makes it immutable but also difficult in some ways.

AArcitec I don't know how permanent that is. It tells Kickstart to install Fedora with th...