Comment # 28 on bug 1228863 from Marc Thomas

(In reply to Alberto Planas Dominguez from comment #27)
> But this SbatLevel has an associated component? Its column was empty, right?
It was:
620-secureboot-authority          Authority: SbatLevel-<guid>

> > /usr/lib/systemd/systemd-pcrlock:
> > 
> > Garbage after device path end, ignoring.
> > Couldn't find component '250-firmware-config-early' in event log.
> > Couldn't find component '710-kernel-cmdline-boot-loader' in event log.
> > Couldn't find component '750-enter-initrd' in event log.
> 
> Aha this last two looks the cause.
> 
> Can you see if the new initrd is generated, and the new boot entry
> (/boot/efi/EFI/loader/entries) is pointing to the new initrd?  Can you also
> compare the cmdline from the boot entry with the event log? To do that check
> the cmdline that appears in systemd-pcrlock with the one in the boot entry.

I think I would need more help here to get you exactly what you need, as I'm
just a normal user - but I'll try.

The "entries" folder I found in /boot/efi/loader/entries, this folder contains
5 files.
Last file is named aeon-6.10.3-1-default-5.conf and contains the following:

# Boot Loader Specification type#1 entry
title      Aeon 20240809
version    5@6.10.3-1-default
sort-key   aeon
options    quiet loglevel=2 systemd.show_status=no console=ttyS0,115200
console=tty0 vt.global_cursor_default=0 ignition.platform.id=metal
security=selinux selinux=1 root=UUID=3b7b704d-a19d-4d5c-b3d8-844c2f43d595
rootflags=subvol=@/.snapshots/5/snapshot
systemd.machine_id=e0cdf1aa6e3f48d1ad509e14e955592f
linux     
/aeon/6.10.3-1-default/linux-f431a68473f70f7db938d56c1a4f039aa439998e
initrd    
/aeon/6.10.3-1-default/initrd-927abaf71095967ff2c0c66a669b8abf774c661b

/usr/lib/systemd/systemd-pcrlock
PCR 12 is the following:
12  kernel-config      ipl ✓ <long hash> F - String:
initrd=\aeon\6.10.3-1-default\initrd-927abaf71095967ff2c0c66a669b8abf774c661b
<same options as in the boot loader entry>

One thing I noticed:
/boot/initrd -> initrd-6.10.3-1-default is currently shown in red. Is this
correct?

> Are you loading the last snpashot?
In think so, I did not select anything before boot if you mean that.
My /etc/os-release shows 20240809 as VERSION_ID.