Lanzaboote Setup Not Working about lanzaboote HOT 7 CLOSED

Do you get this message when you call sbctl verify? The kernel is not supposed to be signed because it could otherwise be used by a sort of downgrade attack where someone with access to your disks could add a systemd-boot type 1 entry and just boot your separately signed kernel.

In short: it is expected that the kernel is not signed. sbctl, however has no way of knowing that we're still booting securely.

from lanzaboote.

Do you get this message when you call sbctl verify? The kernel is not supposed to be signed because it could otherwise be used by a sort of downgrade attack where someone with access to your disks could add a systemd-boot type 1 entry and just boot your separately signed kernel.

In short: it is expected that the kernel is not signed. sbctl, however has no way of knowing that we're still booting securely.

Which is why I was surprised - it wasn't signed on my other machine either, and it was fine. But this machine, when I enable secure boot, it fails to boot with a message (not the above exactly just something like it, but specifically mentioning the bzImage) saying that piece isn't signed properly, the message highlighted in red.

from lanzaboote.

Can you check if you have any old entries in /boot/loader/entries?

from lanzaboote.

I found the issue. My ESP partition was corrupted, I fixed it and redid everything and it resolved it!

from lanzaboote.

Awesome! We actually had a similar situation recently where the ESP was corrupt and systemd-boot just showed no entries because all the kernels and initrds vanished. This would be solved if NixOS would use systemd's automounts where fsck is run on each access. Maybe we just need to add a fsck to lzbt or at least mention it in the docs.

Edit: Awesome that you fixed it, not that the ESP was corrupted :D

from lanzaboote.

We really need to add lzbt fsck yes

from lanzaboote.

We actually had a similar situation recently where the ESP was corrupt and systemd-boot just showed no entries because all the kernels and initrds vanished.

I said that USB keys were not an appropriate medium for NixOS systems :DDDDDDD
FAT32 on USB keys on non-live systems := let's test how non-journaled systems fail in horrible ways :)

from lanzaboote.