forked from pool/shim-leap
joeyli
85b02b1760
- Apply nx-shim, create non-nx shim boot entry:
shim-16.1-lp156.7.1.aarch64.rpm
shim-16.1-lp156.7.1.x86_64.rpm
RPMs are coming from openSUSE secure-boot shim 15.6:
https://build.opensuse.org/projects/openSUSE:Factory:secure-boot/packages/shim/repositories/15.6/binaries
- Version: 16.1, "Aug 14 2025"
- Include the bug fixes for bsc#1205588
- Use nx shim as the default shim binary.
Add Microsoft-signed nx-shim:
Source40 shim-opensuse.nx.x86.efi
Source41 shim-opensuse.nx.aarch64.efi
- Use ms-signed nx shim when the version equals with the version of
newly built shim
- Version mismatch indicates development of a new shim.
- Create non-nx shim boot entry as a fallback option
Because we apply nx shim as the default shim binary in
/boot/efi/EFI/opensuse/shim.efi
/boot/efi/EFI/boot/bootx64.efi or bootaa64.efi
In case that user got any problem when the machine boots with nx-shim,
so we create a new boot entry for non-nx shim as a fallback option by
efibootmgr.
- Removed the override shim-install. Let's direct use the shim-install
script from shim-16.1*.rpm.
Since shim needs a "stable" environment to reproduce the binary to match the signature from UEFI CA, it's difficult to maintain shim in Tumbleweed due to the nature of a rolling release distro. Instead of compiling shim for Tumbleweed, we directly import the binary the latest stable Leap release to maintain a stable and reproducible shim binary.