aaron/nixconfig
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feature(boot): add secure-boot and tpm-unlock to neon #94

Merged
aaron merged 2 commits from feature/neon_secureboot into main 2026-10-03 16:22:30 +02:00
Conversation 0 Commits 2 Files Changed 2
+10
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit e35311dfd5 - Show all commits
INSTALLATION.md
+10
View File
@@ -149,6 +149,16 @@ $ sudo sbctl enroll-keys
Don't force it, either trust exactly those with `--tpm-eventlog` or Don't force it, either trust exactly those with `--tpm-eventlog` or
microsoft's keys with `--microsoft`. Without either, the firmware may not microsoft's keys with `--microsoft`. Without either, the firmware may not
start the device, in the worst case the machine doesn't boot at all. start the device, in the worst case the machine doesn't boot at all.
- Check what sbctl found first, a real option ROM has a PCI device path:
```bash
$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
```
- Paths starting with `0407` (firmware volume) are drivers from the firmware
itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
exactly those, after a firmware update they may need to be enrolled again
(disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
setup too, use `--microsoft` there, a refused gpu means no picture at all
6. enable Secure Boot in the firmware and set a firmware password, then check 6. enable Secure Boot in the firmware and set a firmware password, then check
```bash ```bash