Files

Blake Ridgway 0361c12c07 fix: resolve grub-pc / grub-efi-amd64 "held broken packages" conflict

The edition package lists installed BOTH grub-pc and grub-efi-amd64
(+ shim-signed). Those provide the same bootloader role and conflict in
apt, so every rootfs build failed with "unable to correct problems, you
have held broken packages".

A rootfs now carries exactly ONE bootloader, chosen by the BOOT variable
(mirroring the existing --boot bios|efi deploy option):

- versions.mk / common.sh: BOOT := bios (bios -> grub-pc,
  efi -> grub-efi-amd64 + shim-signed + mokutil), exported via the
  Makefile.
- build-rootfs.sh validates BOOT early and injects the matching boot
  packages into the apt install; the static package lists no longer
  contain any grub package.
- deploy-disk.sh / build-image.sh / install.sh default --boot from the
  same BOOT variable, so a rootfs and the artifact deployed from it can
  never disagree (BOOT=efi make image-cloud produces a UEFI image).
- mokutil is now installed explicitly in the efi flavour (it was not
  pulled in because we install with --no-install-recommends).
- docs updated (building.md knob + rationale, secureboot.md note).

2026-08-21 14:15:10 -05:00

2.3 KiB

Raw Blame History

Secure boot (MOK-based)

Arcline can ship self-signed boot chains verified by your machine's own secure-boot firmware. We use a Machine Owner Key (MOK) — the same approach used to load custom kernels on Windows-certified laptops — rather than paying for a Microsoft KEK signing cert. You own the key, you own the trust anchor.

 MOK.priv ──(sbsign)──► vmlinuz, grubx64.efi, shimx64.efi
 MOK.der  ──(mokutil)──► enrolled into firmware MOK list (one-time prompt)

Workflow

Generate the key (once, keep it secret):

scripts/secureboot/gen-keys.sh            # → build/keys/{MOK.priv,MOK.pem,MOK.der}

Build a signed image (ISO or disk image):
```
ARCLINE_SIGN=1 make iso-server
ARCLINE_SIGN=1 make image-cloud
```
The build signs every kernel + EFI binary in the boot chain with the MOK and ships the public MOK.der into the image at /etc/arcline/MOK.der.
Enroll on first boot — the arcline-mok-enroll.service unit imports the key automatically the first time the system boots with secure boot enabled. The firmware shows a one-time "Enroll MOK" prompt; confirm it, reboot, done. The unit disables itself afterwards (and no-ops entirely when no key was shipped — secure boot is off by default).

Manual alternative:
```
sudo mokutil --import /etc/arcline/MOK.der
sudo reboot   # then confirm at the blue MOK manager screen
```

What gets signed

kernels (vmlinuz*) — in /boot for installed systems, /live for ISOs
EFI binaries (*.efi) — grubx64, shimx64, mmx64, fbx64

GRUB .mod modules are not PE binaries and are not individually signed (GRUB has its own module-signature mechanism, out of scope here). If you use the shim-provided fallback loader, the Microsoft-signed shim validates grubx64.efi against your MOK.

Notes

Requires sbsigntool on the build host. mokutil (for enrollment) is installed in the image as part of the EFI boot flavour: BOOT=efi make iso-server (the efi flavour adds grub-efi-amd64 shim-signed mokutil).
Losing MOK.priv means you cannot sign future updates — back it up.
Full vendor CA / Microsoft KEK signing is intentionally not used; revisit only if a commercial distribution is ever pursued.

2.3 KiB Raw Blame History

Secure boot (MOK-based)

Workflow

What gets signed

Notes

2.3 KiB

Raw Blame History