this post was submitted on 20 Jul 2025
83 points (100.0% liked)

Linux

8652 readers
471 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
83
Linux and Secure Boot certificate expiration (lwn.net)
submitted 1 week ago by cm0002@programming.dev to c/linux@programming.dev
25 comments fedilink hide all child comments
 

Linux users who have Secure Boot enabled on their systems knowingly or unknowingly rely on a key from Microsoft that is set to expire in September. After that point, Microsoft will no longer use that key to sign the shim first-stage UEFI bootloader that is used by Linux distributions to boot the kernel with Secure Boot. But the replacement key, which has been available since 2023, may not be installed on many systems; worse yet, it may require the hardware vendor to issue an update for the system firmware, which may or may not happen. It seems that the vast majority of systems will not be lost in the shuffle, but it may require extra work from distributors and users.

you are viewing a single comment's thread
view the rest of the comments
[–] Infernal_pizza@lemmy.dbzer0.com 8 points 1 week ago (2 children)

Are there any hardware manufacturers that aren't completely shit at providing firmware updates? My motherboard does still get updates but they can take a while to arrive even when there's a known exploit for my CPU which requires a firmware update to fix (made even worse by the fact that AMD are awful at providing fixes in the first place)

[–] SheeEttin@lemmy.zip 1 points 1 week ago

Only the really big names like Intel, Dell, HP... but even then they'll still go out of support eventually.

[–] 9tr6gyp3@lemmy.world 0 points 1 week ago

AMD are generally quick with providing microcode updates. Once they have them, they provide them to your motherboard manufacturer to include in a firmware update. This is the part that usually takes a while, if done at all.