Enable UEFI Secure Boot - #697
Open
s4heid wants to merge 1 commit into
Open
Conversation
Secure Boot requires a Microsoft-signed shim that chainloads a Canonical-signed GRUB. Installing grub-efi-amd64-signed and shim-signed makes grub-install lay down that chain instead of the unsigned image it builds itself. Signed GRUB binaries carry their prefix baked in, and it cannot be changed without invalidating the signature. With --removable, grub-install installs gcdx64.efi.signed as EFI/BOOT/grubx64.efi, whose prefix is /boot/grub relative to the partition it was loaded from - the ESP. That image never reads the redirect grub-install writes to EFI/BOOT/grub.cfg, so without a config at the path it does read, GRUB drops into the rescue shell. Copy grub-install's own redirect there instead of hardcoding the ESP UUID a second time.
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
cf-foundation-community-automation
Bot
moved this to Inbox
in Foundational Infrastructure Working Group
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
github-project-automation
Bot
moved this from Inbox
to Pending Merge | Prioritized
in Foundational Infrastructure Working Group
beyhan
requested review from
a team,
ragaskar and
ystros
and removed request for
a team
July 30, 2026 14:45
beyhan
moved this from Pending Merge | Prioritized
to Pending Review | Discussion
in Foundational Infrastructure Working Group
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stemcells currently ship an unsigned GRUB, so they cannot boot on a VM where UEFI Secure Boot is enforced (e.g. Azure Secure Boot / Trusted Launch). This installs the signed boot chain and puts GRUB's config where the signed binary looks for it.
The extra grub.cfg is needed, because the signed GRUB binaries have their prefix baked in at build time, and changing it invalidates the signature. With
--removable,grub-installinstallsgcdx64.efi.signedunderEFI/BOOT/grubx64.efiand that image's prefix is/boot/grub, resolved against the partition it was loaded from, i.e. the ESP. It therefore never reads the redirectgrub-installwrites toEFI/BOOT/grub.cfg. With no config at the path it does read, GRUB drops into the rescue shell. Copyinggrub-install's generated redirect to that path fixes it.Reviewer Note
This change affects all IaaS and secure boot then works wherever a platform enforces it. Azure Gen2 Trusted Launch is one such case, and is where this was validated. However, it would be good, if someone with access to another IaaS could validate this doesn't break anything.
Validation
Booted a stemcell built from this branch on an Azure Gen2 Trusted Launch VM with Secure Boot enabled and Standard VM.