Bug#909718: debian-live: bootia32.efi + UEFI32 + SecureBoot => certificate error

[beta-tester]

Package: debian-live
Severity: normal

Dear Maintainer,

i have a tablet/netbook with:

- 32bit UEFI (only),
- SecureBoot enabled,
- 32/64bit CPU,
- Windows 10 Pro (32bit)

i can't use the live-dvd 64bit, 32bit version nor the multi-arch (debian-9.5.0-amd64-i386-netinst.iso) to boot LiveDVD or LiveUSB,
because bootia32.efi on the Live iso media isn't signed properly.
i get a signed certificat error at boot time from UEFI.

on a PC with 64bit UEFI and SecureBoot enabled i don't have that problem.

why is the bootx64.efi signed properly for SecureBoot an UEFI 64bit,
but bootia32.efi isn't signed properly for SecureBoot an UEFI 32bit ?

i tried the folowing iso images:
debian-9.5.0-amd64-i386-netinst.iso (it has /efi/boot/bootia32.efi and bootx64.efi, but not signed properly for UEFI32 + SecureBoot)
debian-live-9.5.0-amd64-lxde.iso (it has no bootx64.efi and no bootia32.efi at all)
debian-live-9.5.0-i386-lxde.iso (it has no bootia32.efi at all)

i don't knbow where in which package the issue is.
shim-signed, grub-efi-ia32-signed*, live-*, or where even


-- System Information:
Debian Release: 9.5
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-7-amd64 (SMP w/8 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

[Steve McIntyre]

Post by beta-tester
Package: debian-live
Severity: normal
Dear Maintainer,
- 32bit UEFI (only),
- SecureBoot enabled,
- 32/64bit CPU,
- Windows 10 Pro (32bit)
i can't use the live-dvd 64bit, 32bit version nor the multi-arch
(debian-9.5.0-amd64-i386-netinst.iso) to boot LiveDVD or LiveUSB,
because bootia32.efi on the Live iso media isn't signed properly. i
get a signed certificat error at boot time from UEFI.
on a PC with 64bit UEFI and SecureBoot enabled i don't have that problem.
why is the bootx64.efi signed properly for SecureBoot an UEFI 64bit,
but bootia32.efi isn't signed properly for SecureBoot an UEFI 32bit ?

We don't have Secure Boot enabled for *any* of our 9.x images
yet. Your 64-bit PC must have SB disabled, or it's ignoring the lack
of signature. Maybe it's booting in BIOS mode?

[beta-tester]

Package: debian-live
Followup-For: Bug #909718

Dear MaintaineSteve McIntyre,

my system have UEFI 32 only, a "legacy" BIOS mode does not exist.

i can not disable SecureBoot.
the Windows System Partition is encrypted by BitLocker on the har drive,
and i saw a video where somebody disabled SecureBoot to boot Linux Live
and after re-enabling SecureBoot later to boot into Windows again,
the system run into BitLocker Recovery mode,
and he had to use BitLocker Recovery to decrypt and re-encrypt everything again.

so disabling SecureBoot will destroy the stored BitLocker-key somehow.

thats because disabling SecureBoot is not an option.


why are UEFI32 only tablet/netbook users disadvantaged or excluded
from using Linux / Debian?
i mean to me it looks like it is only a matter of providing proper signed
grub-efi-ai32-signed package or shim-signed or what ever packages are involved.

or is Debian Linux Live friendly only for big customers with big hardware?
sorry, but i am a bit disappointed.

[Steve McIntyre]

Post by beta-tester
Package: debian-live
Followup-For: Bug #909718
Dear MaintaineSteve McIntyre,
my system have UEFI 32 only, a "legacy" BIOS mode does not exist.
i can not disable SecureBoot.
the Windows System Partition is encrypted by BitLocker on the har drive,
and i saw a video where somebody disabled SecureBoot to boot Linux Live
and after re-enabling SecureBoot later to boot into Windows again,
the system run into BitLocker Recovery mode,
and he had to use BitLocker Recovery to decrypt and re-encrypt everything again.
so disabling SecureBoot will destroy the stored BitLocker-key somehow.
thats because disabling SecureBoot is not an option.

OK, so that's a limitation on your system.

Post by beta-tester
why are UEFI32 only tablet/netbook users disadvantaged or excluded
from using Linux / Debian?
i mean to me it looks like it is only a matter of providing proper signed
grub-efi-ai32-signed package or shim-signed or what ever packages are involved.

We're working on providing appropriate signed packages for various
architectures, but we're not 100% there yet. We already support 32-bit
UEFI systems in general, but if something else is stopping you from
disabling Secure Boot then that is a blocker *for now*.

Post by beta-tester
or is Debian Linux Live friendly only for big customers with big hardware?

I don't understand why you're making that unhelpful comment.

[beta-tester]

Package: debian-live
Followup-For: Bug #909718

Dear Steve,

i am sorry for my unhelpful words of my previous post.
i was so frustrated with the situation. please forgive me.


today i tried Fedora 29 Workstation Live (64bit).
there is a bootia32.efi that is correctly Microsoft UEFI CA signed.
with that version i can boot and use Fedora 29
on all my UEFI32 + SecureBoot enabled devices successfully.
i hope it will be fixed for Debian as well soon...

sudo /usr/bin/sbverify --list BOOTIA32.EFI
warning: data remaining[839112 vs 975536]: gaps between PE/COFF sections?
signature 1
image signature issuers:
- /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
image signature certificates:
- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows UEFI Driver Publisher
issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
- subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation Third Party Marketplace Root