aaron/nixconfig
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feature(boot): add secure-boot and tpm-unlock to neon #94

Merged
aaron merged 2 commits from feature/neon_secureboot into main 2026-10-03 16:22:30 +02:00
Conversation 0 Commits 2 Files Changed 2
+10
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit e35311dfd5 - Show all commits
INSTALLATION.md
+10
View File
@@ -149,6 +149,16 @@ $ sudo sbctl enroll-keys
Don't force it, either trust exactly those with `--tpm-eventlog` or
microsoft's keys with `--microsoft`. Without either, the firmware may not
start the device, in the worst case the machine doesn't boot at all.
- Check what sbctl found first, a real option ROM has a PCI device path:
```bash
$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
```
- Paths starting with `0407` (firmware volume) are drivers from the firmware
itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
exactly those, after a firmware update they may need to be enrolled again
(disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
setup too, use `--microsoft` there, a refused gpu means no picture at all
6. enable Secure Boot in the firmware and set a firmware password, then check
```bash