Hi, just got a new laptop with Windows 11 installed and I'm not supposed to remove Win 11 completely ;-) but want to install Tumbleweed in dual boot. Since apparently I'm installing only every few years it's always again "interesting". I downloaded a recent Tumbleweed snapshot and wrote it to a USB stick but I cannot boot from it as the system tells me that the secure boot signature is invalid. When trying to search for the issue I cannot find much. I found that Tumbleweed should be supporting secure boot completely and therefore I have no idea what might be wrong as apparently is meant to just work. Any pointers? Thanks, Wolfgang
Am Samstag, 29. April 2023, 23:07:23 CEST schrieb Wolfgang Rosenauer:
Hi,
just got a new laptop with Windows 11 installed and I'm not supposed to remove Win 11 completely ;-) but want to install Tumbleweed in dual boot. Since apparently I'm installing only every few years it's always again "interesting".
I downloaded a recent Tumbleweed snapshot and wrote it to a USB stick but I cannot boot from it as the system tells me that the secure boot signature is invalid. When trying to search for the issue I cannot find much. I found that Tumbleweed should be supporting secure boot completely and therefore I have no idea what might be wrong as apparently is meant to just work.
Any pointers?
Thanks, Wolfgang
Which ISO? Have you compared the checksum of the downloaded ISO? How do you write the ISO to the stick? with dd? Stephan
Am 29.04.23 um 23:17 schrieb Stephan Hemeier:
Am Samstag, 29. April 2023, 23:07:23 CEST schrieb Wolfgang Rosenauer:
Hi,
just got a new laptop with Windows 11 installed and I'm not supposed to remove Win 11 completely ;-) but want to install Tumbleweed in dual boot. Since apparently I'm installing only every few years it's always again "interesting".
I downloaded a recent Tumbleweed snapshot and wrote it to a USB stick but I cannot boot from it as the system tells me that the secure boot signature is invalid. When trying to search for the issue I cannot find much. I found that Tumbleweed should be supporting secure boot completely and therefore I have no idea what might be wrong as apparently is meant to just work.
Any pointers?
Which ISO?
openSUSE-Tumbleweed-DVD-x86_64-Snapshot20230425-Media.iso
Have you compared the checksum of the downloaded ISO?
I think I did not but as the image is now gone from download I can only grab the latest one and try again. Will do and report back
How do you write the ISO to the stick? with dd?
yes, as documented dd if=openSUSE-Tumbleweed-NET-x86_64-Snapshot20230428-Media.iso of=/dev/sdc bs=4M status=progress && sync Wolfgang
* Wolfgang Rosenauer <wolfgang@rosenauer.org> [04-29-23 17:07]:
Hi,
just got a new laptop with Windows 11 installed and I'm not supposed to remove Win 11 completely ;-) but want to install Tumbleweed in dual boot. Since apparently I'm installing only every few years it's always again "interesting".
I downloaded a recent Tumbleweed snapshot and wrote it to a USB stick but I cannot boot from it as the system tells me that the secure boot signature is invalid. When trying to search for the issue I cannot find much. I found that Tumbleweed should be supporting secure boot completely and therefore I have no idea what might be wrong as apparently is meant to just work.
Any pointers?
disable "secure boot" and boot the usb stick, do your install. then re-enable secure boot. and you may have to disable windows raid when you disable "secure boot" in order to see entire disk space. I copy the windows system to a usb drive, then wipe the disk and install Tumbleweed. I recently had to return two boxes, just returned the windows system to disk and system didn't know anything had been changed. gudluk, -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri Photos: http://wahoo.no-ip.org/piwigo paka @ IRCnet oftc
On 30.04.2023 00:07, Wolfgang Rosenauer wrote:
Hi,
just got a new laptop with Windows 11 installed and I'm not supposed to remove Win 11 completely ;-) but want to install Tumbleweed in dual boot. Since apparently I'm installing only every few years it's always again "interesting".
I downloaded a recent Tumbleweed snapshot and wrote it to a USB stick but I cannot boot from it as the system tells me that the secure boot signature is invalid. When trying to search for the issue I cannot find much. I found that Tumbleweed should be supporting secure boot completely and therefore I have no idea what might be wrong as apparently is meant to just work.
Any pointers?
Hi, Am 29.04.23 um 23:41 schrieb Andrei Borzenkov:
On 30.04.2023 00:07, Wolfgang Rosenauer wrote:
Hi,
just got a new laptop with Windows 11 installed and I'm not supposed to remove Win 11 completely ;-) but want to install Tumbleweed in dual boot. Since apparently I'm installing only every few years it's always again "interesting".
I downloaded a recent Tumbleweed snapshot and wrote it to a USB stick but I cannot boot from it as the system tells me that the secure boot signature is invalid. When trying to search for the issue I cannot find much. I found that Tumbleweed should be supporting secure boot completely and therefore I have no idea what might be wrong as apparently is meant to just work.
Any pointers?
if I understand it right this bug is only? about systems with multiple Linuxes installed which use shim? Mine is "just" Windows 11 at the moment and even booting from the USB ISO is already failing. Not sure if those are connected. Wolfgang
On 30.04.2023 09:29, Wolfgang Rosenauer wrote:
Hi,
Am 29.04.23 um 23:41 schrieb Andrei Borzenkov:
On 30.04.2023 00:07, Wolfgang Rosenauer wrote:
Hi,
just got a new laptop with Windows 11 installed and I'm not supposed to remove Win 11 completely ;-) but want to install Tumbleweed in dual boot. Since apparently I'm installing only every few years it's always again "interesting".
I downloaded a recent Tumbleweed snapshot and wrote it to a USB stick but I cannot boot from it as the system tells me that the secure boot signature is invalid. When trying to search for the issue I cannot find much. I found that Tumbleweed should be supporting secure boot completely and therefore I have no idea what might be wrong as apparently is meant to just work.
Any pointers?
if I understand it right this bug is only? about systems with multiple Linuxes installed which use shim?
No. This bug is about using SBAT to block previous loader versions. It does not matter from which operating system this restriction comes from.
Mine is "just" Windows 11 at the moment and even booting from the USB ISO is already failing. Not sure if those are connected.
I could not find any reference to SBAT on Microsoft site, but shim readme describes it as co-developed with Microsoft and I will not be surprised if recent updates to Windows 11 set SbatLevel that blocks Tumbleweed. Somewhere in this bug report there was link to image with updated shim. Can you boot this image? Unfortunately SbatLevel is boot-time only variable, so unless Windows shadows it to OS like shim does the only way to check it is running EfiShell. If you have possibility to boot it, it would be interesting to check SbatLevel. I am downloading Windows 11 22H2, but I have heard that it may not work in QEMU, we'll see.
On 30.04.2023 09:48, Andrei Borzenkov wrote:
I am downloading Windows 11 22H2, but I have heard that it may not work in QEMU, we'll see.
So far I cannot even boot it. I get "Press any key to boot from CD" prompt and nothing happens after I press it, I just get black screen with EFI logo.
On Sun, 2023-04-30 at 11:10 +0300, Andrei Borzenkov wrote:
On 30.04.2023 09:48, Andrei Borzenkov wrote:
I am downloading Windows 11 22H2, but I have heard that it may not work in QEMU, we'll see.
So far I cannot even boot it. I get "Press any key to boot from CD" prompt and nothing happens after I press it, I just get black screen with EFI logo.
Something interesting seems to have happened between (possibly) version 7.1.0-12 and 7.1.0-16.1; I'm not sure when it starting [mis]behaving this way or if the issues comes from something libvirt related, but I was able to install Win11 via QEMU on Mar 14th, but another attempt sometime around mid-April hangs up same as you describe. Existing Win11 install is fine. Happens on an Intel system and a Ryzen system in the exact same way. 2023-03-14 08:33:50|command|root@host|'zypper' 'in' '--details' 'virt-manager' 'qemu-kvm'| 2023-03-14 08:33:55|install|qemu-kvm|7.1.0-13.1|x86_64|root@host|download.opensuse.org- oss|<hash>| 2023-03-22 11:27:35|install|qemu-kvm|7.1.0-14.1|x86_64||download.opensuse.org- oss|<hash>| 2023-03-25 21:12:43|install|qemu-kvm|7.1.0-15.1|x86_64||download.opensuse.org- oss|<hash>| 2023-03-30 08:34:47|install|qemu-kvm|7.1.0-16.1|x86_64||download.opensuse.org- oss|<hash>| Even weirder aspect is I have an older Win11 ISO file and that one boots fine; same virtual hardware / setup but with that older ISO - works fine. -- ~ Scott Bradnick | Windows Subsystem for Linux (WSL) Developer |- Tumbleweed: |-- Beelink SER6 Pro [AMD Rembrandt [Radeon 680M]] (x86_64) |-- Dell Precision 5540 [NVIDIA Quadro T1000] (x86_64) |-- IceWhale ZimaBoard 832 [Intel HD Graphics 500] (x86_64) |-- WinBook TW100 (x86_64) |- MicroOS: |-- O-DROID H2+ [UHD Graphics 600] (x86_64) https://keys.openpgp.org/ :: DBC5AA9A2D2BAEBC
On 01.05.2023 17:25, Scott Bradnick via openSUSE Users wrote:
On Sun, 2023-04-30 at 11:10 +0300, Andrei Borzenkov wrote:
On 30.04.2023 09:48, Andrei Borzenkov wrote:
I am downloading Windows 11 22H2, but I have heard that it may not work in QEMU, we'll see.
So far I cannot even boot it. I get "Press any key to boot from CD" prompt and nothing happens after I press it, I just get black screen with EFI logo.
Something interesting seems to have happened between (possibly) version 7.1.0-12 and 7.1.0-16.1; I'm not sure when it starting [mis]behaving this way or if the issues comes from something libvirt related, but I was able to install Win11 via QEMU on Mar 14th, but another attempt sometime around mid-April hangs up same as you describe. Existing Win11 install is fine. Happens on an Intel system and a Ryzen system in the exact same way.
I tried it in Ubuntu 22.04 with both default qemu (6.2) and self-compiled (7.2) and both behave identically. Reports about issues with booting/running Win11 22H2 under KVM date back to October/September '22. On fedora list there was libvirt domain configuration which was claimed "to allow ISO to boot"; to the extent I could translate it to the raw QEMU (I do not use libvirt) it did not. I doubt exact PCI setup is significant here. So far I was not able to find commonality between different reports.
2023-03-14 08:33:50|command|root@host|'zypper' 'in' '--details' 'virt-manager' 'qemu-kvm'| 2023-03-14 08:33:55|install|qemu-kvm|7.1.0-13.1|x86_64|root@host|download.opensuse.org- oss|<hash>| 2023-03-22 11:27:35|install|qemu-kvm|7.1.0-14.1|x86_64||download.opensuse.org- oss|<hash>| 2023-03-25 21:12:43|install|qemu-kvm|7.1.0-15.1|x86_64||download.opensuse.org- oss|<hash>| 2023-03-30 08:34:47|install|qemu-kvm|7.1.0-16.1|x86_64||download.opensuse.org- oss|<hash>|
Even weirder aspect is I have an older Win11 ISO file and that one boots fine;
There are mixed reports about failure to boot 22H2 after update.
same virtual hardware / setup but with that older ISO - works fine.
Am 30.04.23 um 08:48 schrieb Andrei Borzenkov:
On 30.04.2023 09:29, Wolfgang Rosenauer wrote:
Am 29.04.23 um 23:41 schrieb Andrei Borzenkov:
On 30.04.2023 00:07, Wolfgang Rosenauer wrote:
just got a new laptop with Windows 11 installed and I'm not supposed to remove Win 11 completely ;-) but want to install Tumbleweed in dual boot. Since apparently I'm installing only every few years it's always again "interesting".
I downloaded a recent Tumbleweed snapshot and wrote it to a USB stick but I cannot boot from it as the system tells me that the secure boot signature is invalid. When trying to search for the issue I cannot find much. I found that Tumbleweed should be supporting secure boot completely and therefore I have no idea what might be wrong as apparently is meant to just work.
if I understand it right this bug is only? about systems with multiple Linuxes installed which use shim?
No. This bug is about using SBAT to block previous loader versions. It does not matter from which operating system this restriction comes from.
Mine is "just" Windows 11 at the moment and even booting from the USB ISO is already failing. Not sure if those are connected.
I could not find any reference to SBAT on Microsoft site, but shim readme describes it as co-developed with Microsoft and I will not be surprised if recent updates to Windows 11 set SbatLevel that blocks Tumbleweed.
Somewhere in this bug report there was link to image with updated shim. Can you boot this image?
No, I cannot boot any of those: openSUSE-Leap-15.4-CR-DVD-x86_64-Build31.329-Media.iso (from the bugreport) openSUSE-Leap-15.4-NET-x86_64-Build243.2-Media.iso openSUSE-Tumbleweed-DVD-x86_64-Snapshot20230425-Media.iso openSUSE-Tumbleweed-NET-x86_64-Snapshot20230428-Media.iso I'm still a bit confused. When I try to boot from the USB ISO this is the first EFI in the chain. The on-disk EFI is not used. Or is the SBAT minimal version set somewhere in some internal flash memory? Wolfgang
Am 29.04.23 um 23:07 schrieb Wolfgang Rosenauer:
Hi,
just got a new laptop with Windows 11 installed and I'm not supposed to remove Win 11 completely ;-) but want to install Tumbleweed in dual boot. Since apparently I'm installing only every few years it's always again "interesting".
I downloaded a recent Tumbleweed snapshot and wrote it to a USB stick but I cannot boot from it as the system tells me that the secure boot signature is invalid. When trying to search for the issue I cannot find much. I found that Tumbleweed should be supporting secure boot completely and therefore I have no idea what might be wrong as apparently is meant to just work.
Any pointers?
I found the issue: Lenovo requires to change the BIOS to enable Microsoft 3rd party UEFI CA to boot up openSUSE. Wolfgang
participants (5)
-
Andrei Borzenkov -
Patrick Shanahan -
Scott Bradnick -
Stephan Hemeier -
Wolfgang Rosenauer