Secure Boot support
authorMichael Prokop <mika@grml.org>
Thu, 31 Aug 2017 00:54:32 +0000 (02:54 +0200)
committerMichael Prokop <mika@grml.org>
Thu, 31 Aug 2017 00:54:32 +0000 (02:54 +0200)
commit332ae52de9efa6a0ac5c3619823fe547e35828a0
treeefb0e94a7615d0e28e96da8afefd6c7ec9cf2202
parentad58f50169c267ab9eb8d3e67925b8f1d622ba9b
Secure Boot support

Thanks to the way the signed GRUB by Ubuntu works we seem to be
able to keep our common EFI GRUB configs working next to the new
Secure Boot related EFI GRUB configs. If Secure Boot is enabled
we get the same look and feel like with common EFI boot, though
with a Secure Boot specific boot menu (since e.g. the linux16
command isn't available under Secure Boot). If EFI is running
with Secure Boot *disabled* it continues to look like it used to
do so far. If this is working out as planned there's no visible
change from a user point of view on systems with Secure Boot
disabled.

With this change we also get rid of some magic with grml-live
relying on behavior of
/etc/grml/fai/config/scripts/GRMLBASE/45-grub-images, including
moving files around.

We also no longer skip the boot stage during rebuilds. This has
been a source of frustration and annoying debugging sessions when
files inside grml_cd/boot/ didn't receive changes during rebuilds
and the user in front of the system is ignoring the according
"skip" notice or forgot to remove grml_cd/boot.

While at it rewrite debian/copyright in
http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/

Thanks: Michael Schierl <schierlm@gmx.de> for help regarding the Secure Boot setup
12 files changed:
debian/control
debian/copyright
debian/grml-live.install
etc/grml/fai/config/scripts/GRMLBASE/45-grub-images
etc/grml/grml-live.conf
grml-live
templates/EFI/BOOT/README [new file with mode: 0644]
templates/EFI/BOOT/grubx64.efi.signed [new file with mode: 0644]
templates/EFI/BOOT/shimx64.efi.signed [new file with mode: 0644]
templates/EFI/ubuntu/grub.cfg [new file with mode: 0644]
templates/boot/grub/grmlenv.cfg [new file with mode: 0644]
templates/secureboot/grub.cfg [new file with mode: 0644]