We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·Jun 22·5 min read
Linux and Secure Boot certificate expiration
TL;DR
Linux users with Secure Boot enabled rely on a Microsoft key that will expire soon, potentially disrupting boot processes. The replacement key, available since 2023, may not be installed on many systems and could require firmware updates from hardware vendors.
✦ Why It Matters
Engineers should prepare for potential firmware updates to maintain Secure Boot functionality on Linux systems.
Key Takeaways
- Monitor the expiration dates of Secure Boot certificates.
- Check if your system has the new replacement key installed.
- Stay updated on firmware updates from hardware vendors.
- Engage with Linux distribution communities for support.
Full Summary
Secure Boot is a security feature that ensures only trusted software can boot on a system. Linux distributions use a first-stage UEFI bootloader called shim, which is signed with a key from Microsoft that is set to expire in September.
A new key has been available since 2023, but many systems may not have it installed, and updates from hardware vendors may be necessary. Mateus Rodrigues Costa raised concerns about this issue on the Fedora devel mailing list, highlighting the complexity of certificate expiration.
The Linux Vendor Firmware Service (LVFS) provides tools like fwupd to help update system firmware from Linux. While the immediate impact may be limited to new installations, the need for updated keys poses a challenge for maintaining Secure Boot functionality.
Engineers and researchers must be aware of these changes to ensure compatibility and security in their systems.