Dear Maintainer,
Trying to upgrade the package results in the error box shown at:
https://wiki.debian.org/SecureBoot/CAChanges#A1._No_valid_UEFI_Secure_Boot_signatures_found
This, despite Secure Boot being enabled and apparently working for
Debian, Windows 10 Pro, and Arch Linux on this particular machine
(triple boot setup all loaded from Debian's GRUB).
My discovery is that the firmware (latest available as of last week)
does not make the db, dbx, kek, or pk rings visible to the OS:
$ mokutil --db --short
$ mokutil --dbx --short
$ mokutil --kek --short
$ mokutil --pk --short
However, local keys are visible:
$ mokutil --list-enrolled --short
53610cf81f Debian Secure Boot CA
877d1dfca0 Machine Owner Key
877d1dfca0 Machine Owner Key
And Secure Boot is active:
$ mokutil --sb-state
SecureBoot enabled
Attempts at firmware updates result in:
# fwupdtool refresh
Loading… [********************* ]ERROR:tcti:src/tss2-tcti/tcti-device.c:455:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: No such file or directory
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:149:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0
ERROR:tcti:src/tss2-tcti/tcti-device.c:506:Tss2_Tcti_Device_Init() timeout waiting for response from fd 17
Loading… [************************************** ]
Metadata is up to date; use --force to refresh again.
# fwupdtool get-updates
Loading… [********************* ]ERROR:tcti:src/tss2-tcti/tcti-device.c:455:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: No such file or directory
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:149:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0
ERROR:tcti:src/tss2-tcti/tcti-device.c:506:Tss2_Tcti_Device_Init() timeout waiting for response from fd 17
Loading… [************************************** ]
Devices with no available firmware updates:
• SPCC M.2 SSD
• System Firmware
• UEFI Device Firmware
• UEFI Device Firmware
• SBAT
No updates available for remaining devices
# fwupdtool update
Loading… [********************* ]ERROR:tcti:src/tss2-tcti/tcti-device.c:455:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: No such file or directory
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:149:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0
ERROR:tcti:src/tss2-tcti/tcti-device.c:506:Tss2_Tcti_Device_Init() timeout waiting for response from fd 18
Loading… [************************************** ]
Devices with no available firmware updates:
• SPCC M.2 SSD
• System Firmware
• UEFI Device Firmware
• UEFI Device Firmware
• SBAT
Further research led me to this link which summarizes well what I have found
with this laptop:
https://forums.gentoo.org/viewtopic.php?t=1168749
So far I've not found a setting which exposes the key rings to the OS.
As near as I can tell, /sys/firmware/efi/efivars/ is correctly mounted:
# ls /sys/firmware/efi/efivars/
54EE7594E70B-937fe521-95ae-4d1a-8929-48bcd90ad31a LBOP0007-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
AcpiGlobalVariable-c020489e-6db2-4ef2-9aa5-ca06fc11d36a LBOP0008-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
AcpiProtocolSetupVar-1054354b-b543-4dfe-558b-a7ad6351c9d8 LBOP0009-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
AmtSetup-4b9f56be-f68e-4bbc-9bab-cdf600f52d30 LBOP000A-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
BiosSetup-0b7646a4-6b44-4332-8588-c8998117f2ef LBOP000B-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot0000-8be4df61-93ca-11d2-aa0d-00e098032b8c LBOP000C-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot0001-8be4df61-93ca-11d2-aa0d-00e098032b8c LBOP000D-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot0002-8be4df61-93ca-11d2-aa0d-00e098032b8c LBOP000E-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot0003-8be4df61-93ca-11d2-aa0d-00e098032b8c LBOP000F-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot0004-8be4df61-93ca-11d2-aa0d-00e098032b8c LBOP0010-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot0005-8be4df61-93ca-11d2-aa0d-00e098032b8c LBOP0011-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot0006-8be4df61-93ca-11d2-aa0d-00e098032b8c LBOP0012-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot0007-8be4df61-93ca-11d2-aa0d-00e098032b8c LBOP0013-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot0008-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoBDG-49ad5446-9d32-4455-af9b-d774bda2cf8b
Boot0009-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoConfig-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot000A-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoFprData-867eff85-1886-4a9e-a74f-ab374360e719
Boot000B-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoFunctionConfig-580020c3-6c9c-4f93-8008-7fadc1fcfedd
Boot000C-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoHdpSmm-edf349d8-12f2-4163-ab09-a11c8f748f0d
Boot000D-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoHiddenSetting-1827cfc7-4e61-4273-b796-d35f4b0c88fc
Boot000E-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoScratchData-67c3208e-4fcb-498f-9729-0760bb4109a7
Boot000F-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoSecurityConfig-a2c1808f-0d4f-4cc9-a619-d1e641d39d49
Boot0010-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoSkipACCheck-c69efd4d-8c49-437a-803b-0b5434f398ca
Boot0011-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoSystemConfig-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
Boot0012-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoThermalShutdown-943d1460-da6e-499a-af6d-4593b12bc4d7
Boot0013-8be4df61-93ca-11d2-aa0d-00e098032b8c LenovoWmaSupport-286091ef-33a8-48e6-af77-1e03344c7a18
BootAllCDROM-0b7646a4-6b44-4332-8588-c8998117f2ef LenovoWolInfo-0af4027f-9b58-41c0-b62f-cd3a1cef54ee
BootAllHDD-0b7646a4-6b44-4332-8588-c8998117f2ef LFS-90564d52-f26b-4fac-8d16-7a51422c51f1
BootAllPciLan-0b7646a4-6b44-4332-8588-c8998117f2ef LKOP0000-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
BootCurrent-8be4df61-93ca-11d2-aa0d-00e098032b8c LKOP0001-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
BootMenu-0b7646a4-6b44-4332-8588-c8998117f2ef LKOP0002-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
BootOptionNo_01-0b7646a4-6b44-4332-8588-c8998117f2ef LKOP0003-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
BootOptionNo_02-0b7646a4-6b44-4332-8588-c8998117f2ef LKOP0004-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
BootOptionNo_03-0b7646a4-6b44-4332-8588-c8998117f2ef LKOP0005-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
BootOptionSupport-8be4df61-93ca-11d2-aa0d-00e098032b8c LKOP0006-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
BootOrder-8be4df61-93ca-11d2-aa0d-00e098032b8c LnvActivationVar-e5bbf7be-2417-499b-97db-39f4896391bc
BootOrderDefault-0b7646a4-6b44-4332-8588-c8998117f2ef LnvOA3ID-e5bbf7be-2417-499b-97db-39f4896391bc
BugCheckCode-ba57e015-65b3-4c3c-b274-659192f699e3 LnvOSLicDesc-e5bbf7be-2417-499b-97db-39f4896391bc
BugCheckParameter1-ba57e015-65b3-4c3c-b274-659192f699e3 LoaderSystemToken-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
BugCheckProgress-ba57e015-65b3-4c3c-b274-659192f699e3 LocalSecurityVars-47355e9f-0857-45e1-8a6f-a4f5eda89a77
BuildTime-e5bbf7be-2417-499b-97db-39f4896391bc LWO-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65
ClientId-9fb9a8a1-2f4a-43a6-889c-d0f7b6c47ad5 MailBoxQ-67c3208e-4fcb-498f-9729-0760bb4109a7
ConIn-8be4df61-93ca-11d2-aa0d-00e098032b8c MeBiosExtensionSetup-1bad711c-d451-4241-b1f3-8537812e0c70
ConInDev-8be4df61-93ca-11d2-aa0d-00e098032b8c MemoryOverwriteRequestControl-e20939be-32d4-41be-a150-897f85d49829
ConOut-8be4df61-93ca-11d2-aa0d-00e098032b8c MemoryTypeInformation-4c19049f-4137-4dd3-9c10-8b97a83ffdfa
ConOutDev-8be4df61-93ca-11d2-aa0d-00e098032b8c MemoryTypeInformationBackup-4c19049f-4137-4dd3-9c10-8b97a83ffdfa
ConsoleLock-368cda0d-cf31-4b9b-8cf6-e7d1bfff157e MemRestoreVariable-608dc793-15de-4a7f-a0c5-6c29beaf5d23
CpuPpiSetupVar-d1b99f1a-084b-49c3-b88e-378abefa118b MeSetup-fb7b1de3-295b-433c-95a2-091fe3218bf9
CpuProtocolSetupVar-7d4adce1-930d-40c7-9cd2-6d2148413dc7 MokListRT-605dab50-e046-4300-abb6-3dd810dd8b23
CurrentPolicy-77fa9abd-0359-4d32-bd60-28f4e78f784b MokListTrustedRT-605dab50-e046-4300-abb6-3dd810dd8b23
DIAGSPLSHSCRN-a7d8d9a6-6ab0-4aeb-ad9d-163e59a7a380 MokListXRT-605dab50-e046-4300-abb6-3dd810dd8b23
DisplaySaveStateVar-be3e3f80-7aca-4101-852d-7616929094d9 MTC-eb704011-1402-11d3-8e77-00a0c969723b
ErrOutDev-8be4df61-93ca-11d2-aa0d-00e098032b8c OfflineUniqueIDEKPubCRC-eaec226f-c9a3-477a-a826-ddc716cdc0e3
ESRTPLATFORMENTRY-6eb9a2b4-58bf-41bc-81a6-c9bad152efb3 OfflineUniqueIDEKPub-eaec226f-c9a3-477a-a826-ddc716cdc0e3
FirmwarePerformanceDataTable-9dab39a4-3f8a-47ac-80c3-400729332c81 OsIndications-8be4df61-93ca-11d2-aa0d-00e098032b8c
GopConfigSetupVar-6e61d5b9-70d0-4c18-8af2-f1ccde2d88cf OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c
IccString-c1e2774b-9ed4-4103-aefa-33b8149eccf6 PartNumber-e5bbf7be-2417-499b-97db-39f4896391bc
IEIT-955b9041-133a-4bcf-90d1-97e1693c0e30 PbaStatusVar-0ec1a7f5-4904-40a0-8eab-4bcc4666da45
Key0000-8be4df61-93ca-11d2-aa0d-00e098032b8c PBRDevicePath-a9b5f8d2-cb6d-42c2-bc01-b5ffaae4335e
Key0001-8be4df61-93ca-11d2-aa0d-00e098032b8c PchPolicyVar-e274d08e-69b6-4497-a4eb-d39c4b2f9fcb
Key0002-8be4df61-93ca-11d2-aa0d-00e098032b8c PlatformLang-8be4df61-93ca-11d2-aa0d-00e098032b8c
Key0003-8be4df61-93ca-11d2-aa0d-00e098032b8c PlatformLangCodes-8be4df61-93ca-11d2-aa0d-00e098032b8c
Key0004-8be4df61-93ca-11d2-aa0d-00e098032b8c PreBootEventLogReset-8b604cac-3c4f-4e6c-862e-00b8b7436e5f
Key0005-8be4df61-93ca-11d2-aa0d-00e098032b8c ProtectedBootOptions-0b7646a4-6b44-4332-8588-c8998117f2ef
Key0006-8be4df61-93ca-11d2-aa0d-00e098032b8c PwdStatusVar-3e72b3ad-2b91-424a-ad73-c3270e91ed88
LastBootCurrent-0b7646a4-6b44-4332-8588-c8998117f2ef SaPpiSetupVar-7da81437-866b-4143-8e08-a25c6ef0fa5b
LastBootOrder-0b7646a4-6b44-4332-8588-c8998117f2ef SaProtocolSetupVar-34f73d4d-963e-4c65-b3b3-515e720175d6
LBC-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65 SbatLevelRT-605dab50-e046-4300-abb6-3dd810dd8b23
LBL-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65 SctHotkey-4650c401-93f1-4aeb-b87d-c8204c047dec
LBOL-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65 SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
lBoot0000-146b234d-4052-4e07-b326-11220f8e1fe8 SecureBootOption-955b9041-133a-4bcf-90d1-97e1693c0e30
lBoot0001-146b234d-4052-4e07-b326-11220f8e1fe8 Setup-4dfbbaab-1392-4fde-abb8-c41cc5ad7d5d
lBoot0002-146b234d-4052-4e07-b326-11220f8e1fe8 SetupHotKey-a7d8d9a6-6ab0-4aeb-ad9d-163e59a7a380
lBoot0003-146b234d-4052-4e07-b326-11220f8e1fe8 SetupMode-8be4df61-93ca-11d2-aa0d-00e098032b8c
lBoot0004-146b234d-4052-4e07-b326-11220f8e1fe8 SignatureSupport-8be4df61-93ca-11d2-aa0d-00e098032b8c
lBoot0005-146b234d-4052-4e07-b326-11220f8e1fe8 SioPolicy-729c67cc-e109-4bc7-97b5-fa7c386e387d
lBoot0006-146b234d-4052-4e07-b326-11220f8e1fe8 SMBIOSELOG000-c3eeae98-23bf-412b-ab60-efcbb48e1534
lBoot0007-146b234d-4052-4e07-b326-11220f8e1fe8 SMBIOSELOGNUMBER-c3eeae98-23bf-412b-ab60-efcbb48e1534
lBoot0008-146b234d-4052-4e07-b326-11220f8e1fe8 SMBIOSEPS-c3eeae98-23bf-412b-ab60-efcbb48e1534
lBoot0009-146b234d-4052-4e07-b326-11220f8e1fe8 SMBIOSMEMSIZE-c3eeae98-23bf-412b-ab60-efcbb48e1534
lBoot000A-146b234d-4052-4e07-b326-11220f8e1fe8 Smst-2a3cfebd-27e8-4d0a-8b79-d688c2a3e1c0
lBoot000B-146b234d-4052-4e07-b326-11220f8e1fe8 SpeakerMuteAndVolume-68ff2659-86dd-425f-9a42-c9884ff9c2f2
lBoot000C-146b234d-4052-4e07-b326-11220f8e1fe8 SplashLogoPackage-e5bbf7be-2417-499b-97db-39f4896391bc
lBoot000D-146b234d-4052-4e07-b326-11220f8e1fe8 System-e947fcf9-dd01-4965-b808-32a7b6815657
lBoot000E-146b234d-4052-4e07-b326-11220f8e1fe8 SystemSecure-3aec3e3f-5342-4e4b-b465-b9699b7376ba
lBoot000F-146b234d-4052-4e07-b326-11220f8e1fe8 Time-470733de-df43-448b-8b45-4eeb0df8c812
lBoot0010-146b234d-4052-4e07-b326-11220f8e1fe8 Timeout-8be4df61-93ca-11d2-aa0d-00e098032b8c
lBoot0011-146b234d-4052-4e07-b326-11220f8e1fe8 TpAcpiNvs-e6f014ab-cb0e-456e-8af7-7221edb702f7
lBoot0012-146b234d-4052-4e07-b326-11220f8e1fe8 TpmAcpiData-6403753b-abde-4da2-aa11-6983ef2a7a69
lBoot0013-146b234d-4052-4e07-b326-11220f8e1fe8 TpmLastOperation-753ab903-444c-41f8-a235-569e8341147e
LBOP0000-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65 TpmNextOperation-753ab903-444c-41f8-a235-569e8341147e
LBOP0001-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65 TpmOperationResult-753ab903-444c-41f8-a235-569e8341147e
LBOP0002-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65 TpmSaveState-5e724c0c-5c03-4543-bcb6-c1e23de24136
LBOP0003-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65 TpmSetup-753ab903-444c-41f8-a235-569e8341147e
LBOP0004-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65 UCR-14a22a97-8424-489e-9ead-dc09255658b5
LBOP0005-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65 UnlockIDCopy-eaec226f-c9a3-477a-a826-ddc716cdc0e3
LBOP0006-2a4dc6b7-41f5-45dd-b46f-2dd334c1cf65 WorkingSig-955b9041-133a-4bcf-90d1-97e1693c0e30
Additional information:
System Information
Manufacturer: LENOVO
Product Name: 20BS0031US
Version: ThinkPad X1 Carbon 3rd
BIOS Information
Vendor: LENOVO
Version: N14ET56W (1.34 )
Release Date: 08/31/2021
At this point I am holding shim-signed at version 1.47,+15.8-1 but I
suspect that eventually this will fail signature checks with upgraded
kernels, etc.
- - Nate
- -- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.95+deb13-amd64 (SMP w/4 CPU threads; PREEMPT)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages shim-signed depends on:
ii grub-efi-amd64-bin 2.12-9+deb13u2
ii grub2-common 2.12-9+deb13u2
ii shim-helpers-amd64-signed 1+16.1+2~deb13u1
ii shim-signed-common 1.51~1+deb13u1+16.1-2~deb13u1
shim-signed recommends no packages.
shim-signed suggests no packages.
- -- debconf information:
shim-signed/revoked-sig:
* shim-signed/no-valid-sigs:
-----BEGIN PGP SIGNATURE-----
iGsEARECACsWIQSC1k9rDmfNQfaJu6b7LFEw1VqIGQUCamCtQA0cbjBuYkBuMG5i
LnVzAAoJEPssUTDVWogZg/cAn21NqAN/CvJMHs2NC9zP9lGguwcbAJ0SRmHBFYOz
UkaH9tQpN/UeLKiFYA==
=ul3S
-----END PGP SIGNATURE-----