Universal Blue•2y ago

both are systemd services

budala•6/19/24, 12:49 AM

I want to just have one user flathub repo and nothing else

KKyle Gospo both are systemd services

budala•6/19/24, 12:49 AM

Can you link me the services please?

Kyle GospoOP•6/19/24, 12:49 AM

https://github.com/ublue-os/bazzite/blob/main/system_files/desktop/shared/usr/libexec/bazzite-hardware-setup

GitHub

bazzite/system_files/desktop/shared/usr/libexec/bazzite-hardware-se...

Bazzite is a custom image built upon Fedora Atomic Desktops that brings the best of Linux gaming to all of your devices - including your favorite handheld. - ublue-os/bazzite

Kyle GospoOP•6/19/24, 12:49 AM

https://github.com/ublue-os/bazzite/blob/main/system_files/desktop/shared/usr/libexec/bazzite-user-setup

GitHub

bazzite/system_files/desktop/shared/usr/libexec/bazzite-user-setup ...

Bazzite is a custom image built upon Fedora Atomic Desktops that brings the best of Linux gaming to all of your devices - including your favorite handheld. - ublue-os/bazzite

budala•6/19/24, 12:50 AM

I'll look into these, thanks

budala•6/19/24, 12:50 AM

I don't know why I make so many typos, probably because it's a bit late

KKyle Gospo added extra line at end

RoyalOughtness•6/19/24, 1:12 AM

do you mind doing a click on hwe for a rebuild

RoyalOughtness•6/19/24, 1:12 AM

just so all the images are good on latest

Kyle GospoOP•6/19/24, 1:13 AM

Done

RoyalOughtness•6/19/24, 1:14 AM

thanks

RoyalOughtness•6/19/24, 2:30 AM

one question is, will this affect ucore at some point down the line? I assume it would

RoyalOughtness•6/19/24, 2:31 AM

probably good to do it well in advance now that we know what the fix is

j0rge•6/19/24, 3:31 AM

@Kyle Gospo back

j0rge•6/19/24, 3:31 AM

https://universal-blue.discourse.group/t/bluefin-no-longer-boots-after-update-bad-shim-signature/2373/10

Universal Blue

Bluefin no longer boots after update ("bad shim signature")

Yeah we’re going to see if we can fix this without having to do all that, hang tight if you can or just stay on yesterday’s image.

j0rge•6/19/24, 3:31 AM

what am I saying here

j0rge•6/19/24, 3:31 AM

sorry, I'm slow and sauced rn lol

j0rge•6/19/24, 3:32 AM

hung out with an old oss friend, described his action usage, we're so small still lol

Kyle GospoOP•6/19/24, 3:59 AM

You can just say it's fixed, and to ensure they have our akmod secure boot key enrolled

fiftydinar•6/19/24, 11:29 AM

Should the MOK screen be requested always now instead of in UEFI only in isogenerator?

fiftydinar•6/19/24, 11:29 AM

nvm, it's all good

M2•6/19/24, 12:42 PM

Uefi is the only thing with secureboot

M2•6/19/24, 12:42 PM

My question is how did this not trigger when F40 was released?

antheas•6/19/24, 1:10 PM

how did this happen? there are no breaking changes with 6.9

antheas•6/19/24, 1:10 PM

did fedora really change the signing key?

M2•6/19/24, 1:20 PM

That's what's confusing for me. There were reports that something like this happened for regular silverblue installs during F40 beta but we never got hit

antheas•6/19/24, 1:21 PM

yeah because ublue has a custom signing key

EyeCantCU•6/19/24, 1:24 PM

Trying to understand more of it but the gist is the shim for grub needed to be updated but SB doesn't currently do that. Why it needed to be updated isn't clear to me

antheas•6/19/24, 1:25 PM

but from what i understand fedora cant update grub or the shim

antheas•6/19/24, 1:25 PM

so they must have cycled the signing key

EyeCantCU•6/19/24, 1:25 PM

Possibly. I'll link the issue if you all want to dig with me

antheas•6/19/24, 1:25 PM

i looked through it

antheas•6/19/24, 1:25 PM

cant understand what happened

EyeCantCU•6/19/24, 1:27 PM

Yeah, I've read through most of it. Causation isn't so clear: https://github.com/fedora-silverblue/issue-tracker/issues/543

EyeCantCU•6/19/24, 1:27 PM

And... Why now and not 3 months ago? What was shielding us?

antheas•6/19/24, 1:28 PM

so the shim contains the singing keys the kernel is allowed to use

antheas•6/19/24, 1:28 PM

old shim = not new keys

antheas•6/19/24, 1:29 PM

probably most ublue installs use a new shim

antheas•6/19/24, 1:29 PM

still not clear what happened to the kernel

antheas•6/19/24, 1:29 PM

bazzite is not affected as it does not use the fedora key anywhere else than grub

antheas•6/19/24, 1:29 PM

and grub is paired with the shim

EyeCantCU•6/19/24, 1:33 PM

Almost sounds like we could've prevented this in 40 at least with this?:

RUN rpm-ostree install bootupd \
    &&\
    /usr/bin/bootupctl backend generate-update-metadata \
    && \
    ostree container commit

RUN rpm-ostree install bootupd \
    &&\
    /usr/bin/bootupctl backend generate-update-metadata \
    && \
    ostree container commit

antheas•6/19/24, 1:34 PM

the bootloader resides in /efi

antheas•6/19/24, 1:34 PM

the update has to be done live and can brick the system

EyeCantCU•6/19/24, 1:36 PM

Isn't that the exact use case of bootupd?

EyeCantCU•6/19/24, 1:38 PM

At least, I saw that was suggested by Timothee for the future to prevent this from occurring. I had assumed that's what it was doing

EyeCantCU•6/19/24, 1:40 PM

Hmm... Yeah, the solution is to outright do what bootupd does: https://github.com/fedora-silverblue/issue-tracker/issues/543#issuecomment-2048350047

antheas•6/19/24, 1:43 PM

Yeah

antheas•6/19/24, 1:43 PM

That's what bootupd does

Aantheas the update has to be done live and can brick the system

antheas•6/19/24, 1:44 PM

That's why bootupd doesn't right now

both are systemd services

Similar Threads

Similar Threads

Similar Threads