JSeems like 6.9.X kernel broke secure boot
Rthis requires ublue to switch everything over to bootc, right?
Ris there an issue for that already
Jyeah
Kwait, where's the kargs defined now?
Krpm-ostree kargs?
Kyes
Jthere's all sorts of issues open for switching to bootc but I don't understand why we haven't merged it yet
Rfor bluefin i think there's a job that sets them after the first boot
Rjust upgraded, getting this also
Rwhy did you delete the photo lol
JGood waa trying to isolate more factors before making the final conclusion
Rit's broken
JThat seals it then 
Rshim signature invalid
R
JIs that a fedora issue or ublue related?
KFedora issue
JGotcha, pinned the prev deployment untill its fixed in upstream
Roof
Ris there an issue / ticket tracking it?
Rlet me check bugzilla
R
KGitHub
Current workaround See #543 (comment) Original issue text Describe the bug Trying to rebase an existing SB39 to SB40 fails to boot showing vmlinuz-6.8.1-300.fc40.x86.x64 has invalid signature. you ...
Rso what's the recommendation for ublue users?
Ri would expect complaints about this to flood in over the next day or two
FI don't use secure boot.
I guess I would still need to do this to fix things long-term?
I guess I would still need to do this to fix things long-term?
Rim gonna pin 40-20240617 in the recipes for all my images temporarily
Athis thread >.>
Jbroken gts, nice. 
Aso they resigned the kernel? whats the problem?
R@Kyle Gospo is there any change the kernel signer can be added to main so that everyone can benefit? 
RJKMain doesn't have the akmod certs since it doesn't ship any
Kit can be added to your own projects built from main though, see j0rge's link
JPR build failed btw
Kyeah, failing to pull locally
Kmay need EyeCantCU's eyes
Ryep, it just means every downstream project now has to manage kernel signing
Rand it means that there's a manual step regardless for those projects since we don't have access to the privkey to sign with so a new key would need to be manually imported by users
Rso downstream projects would be more or less left out to dry
Rwhich like, is well within your right to do
Rbut it would be nice not to
Kunfortunately this is fedora's fuck up, I don't have a quick fix
Keven for bluefin
Ri know. also wait shouldn't you be signing the kernel with the existing key?
