chore: update installation guide with secure-boot setup pitfalls

2026-10-03 16:21:54 +02:00
parent beb520a615
commit e35311dfd5
1 changed files with 10 additions and 0 deletions
@@ -149,6 +149,16 @@ $ sudo sbctl enroll-keys
  Don't force it, either trust exactly those with `--tpm-eventlog` or
  microsoft's keys with `--microsoft`. Without either, the firmware may not
  start the device, in the worst case the machine doesn't boot at all.
+- Check what sbctl found first, a real option ROM has a PCI device path:
+```bash
+$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
+```
+- Paths starting with `0407` (firmware volume) are drivers from the firmware
+  itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
+  exactly those, after a firmware update they may need to be enrolled again
+  (disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
+- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
+  setup too, use `--microsoft` there, a refused gpu means no picture at all

 6. enable Secure Boot in the firmware and set a firmware password, then check
 ```bash