[Bug 1465396] Re: Please provide a signed syslinux-efi for secure-boot enabled systems

[Jason Gerard DeRose]

Well, part of the reason for using syslinux over grub is our imaging
system still needs to support PXE booting legacy BIOS systems, and
syslinux is what we've used historically for that.

The other part is that back when I last tried using grub as a PXE
bootloader, I wasn't able to get it working, although I haven't tried in
a while. But we do have everything working with syslinux now, minus the
signing.

As far as whether we want it signed with a with Microsoft Key or
Canonical Key, I'm not totally clear on the details there, but I think
we want it signed with whatever key is currently used to sign  the shim
and the kernels.

I was under the impression that the Canonical Key was signed by the same
CA that the Microsoft Key is, and that's why you can still install
Ubuntu on systems with secure boot enabled that originally shipped with
Windows.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to syslinux in Ubuntu.
https://bugs.launchpad.net/bugs/1465396

Title:
  Please provide a signed syslinux-efi for secure-boot enabled systems

Status in System76:
  New
Status in syslinux package in Ubuntu:
  Triaged

Bug description:
  syslinux-efi is a great option for PXE booting a UEFI-mode client, but
  the current package is not signed and so cannot be used when secure-
  boot is enable.

  It would be very helpful if there was, say, a `syslinux-signed-efi`
  package similar to `linux-signed-generic`, etc.

  For what it's worth, System76 is working on switching all its products
  to UEFI, and this is one of the last blockers for our imaging system
  (we don't want customers to be confused/concerned about the "booting
  in insecure mode" message).

To manage notifications about this bug go to:
https://bugs.launchpad.net/system76/+bug/1465396/+subscriptions