https://bugzilla.novell.com/show_bug.cgi?id=848797 https://bugzilla.novell.com/show_bug.cgi?id=848797#c1 --- Comment #1 from Günther J. Niederwimmer 2013-11-06 10:49:31 UTC --- Created an attachment (id=566311) --> (http://bugzilla.novell.com/attachment.cgi?id=566311) The db-* File from efivars -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=848797 https://bugzilla.novell.com/show_bug.cgi?id=848797#c Günther J. Niederwimmer changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P2 - High -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=848797 https://bugzilla.novell.com/show_bug.cgi?id=848797#c4 --- Comment #4 from Gary Ching-Pang Lin 2013-11-07 03:35:14 UTC --- The third certificate in db is the MS UEFI CA, so shim shall pass the verification with the certificate. I wonder if it's caused by bad implementation in the firmware :-( I would suggest to upgrade BIOS/UEFI if possible. Enrolling openSUSE key is also worth a try. The key is in /usr/lib64/efi/shim-opensuse.der. You could copy either /usr/lib64/efi/shim-opensuse.efi or /usr/lib64/efi/shim.efi to /boot/efi/EFI/opensuse/ and boot "opensuse-secureboot". -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=848797 https://bugzilla.novell.com/show_bug.cgi?id=848797#c Gary Ching-Pang Lin changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|kernel-maintainers@forge.pr |glin@suse.com |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=848797 https://bugzilla.novell.com/show_bug.cgi?id=848797#c6 --- Comment #6 from Gary Ching-Pang Lin 2013-11-07 10:37:23 UTC --- (In reply to comment #5)

This is the last Bios for this System, but it do not work on other new ASUS Boards like ASUSE P9D WS ...

Have all ASUS Boards this Problem ?

ASUS is using AMI's BIOS. I've tested shim.efi on several AMI development boards, and it worked well in the end. I'm confident the signatures in shim are valid. Please also report the issue to ASUS if possible.

I do this from the Mail,

// Could you try the following instructions?

1. open "yast bootloader" and make sure that "Enable Secure Boot Support" is checked

2. replace shim.efi $ dd if=/usr/lib64/efi/shim.efi of=shim.efi bs=1 count=1378256 $ sudo mv shim.efi /boot/efi/EFI/opensuse/shim.efi

3. reboot and enable secure boot in UEFI

4. boot the system Please make sure UEFI boot the bootentry "opensuse-secureboot" instead of "opensuse" //

But this is not working ? Step2 striped the openSUSE signature and left only MS signature. If the BIOS has problem to verify, it's an issue in the BIOS :-\

-- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=848797 https://bugzilla.novell.com/show_bug.cgi?id=848797#c8 Günther J. Niederwimmer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|gjn@gjn.priv.at | --- Comment #8 from Günther J. Niederwimmer 2013-11-28 09:07:57 UTC --- Hello Jeffrey, YES I download and test the GA, I wrote to ASUS with no helpful answers :(. And it is no new Bios for download :(: Secure Boot is not working. :-( on different ASUS Boards. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=848797 https://bugzilla.novell.com/show_bug.cgi?id=848797#c10 --- Comment #10 from Günther J. Niederwimmer 2014-04-23 07:27:14 UTC --- Hello Gary, I like to check this but I have a Error in step 4 ? gjn@techz:~> pesign -n nssdb/ -r -i /usr/lib64/efi/shim.efi -o shim.efi -u 1 Could not initialize nss: The certificate/key database is in an old, unsupported format. I make the step from the User account in the user Directory you make a sudo ;) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=848797 https://bugzilla.novell.com/show_bug.cgi?id=848797#c12 --- Comment #12 from Günther J. Niederwimmer 2014-04-23 11:29:25 UTC --- Hello Gary, :))))). I have to do the step 4 + 5 as root from C#9, but afterward I mean I have the first time a openSUSE 13.1 starting with Secure Boot. Before when I enable Secure Boot in the Bios only Win8 is starting now I have the Grub Manager and openSUSE is starting. Now the DVD must repaired and it also work with Install ;). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=848797 https://bugzilla.novell.com/show_bug.cgi?id=848797#c14 Jeffrey Cheung changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution| |FIXED --- Comment #14 from Jeffrey Cheung 2014-04-24 04:02:00 UTC --- Hi Günther, Good new to notice that you can now have the Grub Manager and openSUSE is starting under secure boot enabled mode. As Gary said, this is firmware issue who not implement the multiple signatures feature. By the way, I suggest you to write down the above steps first just in case you need to install openSUSE 13.2 on the existing platform later. Anyway, I will close this issue. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=848797 https://bugzilla.novell.com/show_bug.cgi?id=848797#c16 --- Comment #16 from Günther J. Niederwimmer 2014-05-05 10:25:53 UTC --- Hello Gary, before thank's for your work! But I have found this Procedure is not permanent on my system, after a shutdown power off, I have the same Problem then before ;) No Secure Boot possible. But now the good News ;) ASUS have make a New Bios "28.04.2014" for my P8C WS Bord, after many many .... EMails ;) Now the Bios is correct and works with Secure Boot I test it with SLES Beta :-)) Thank you again.... Günther -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.