Description of problem: The hashes are calculated on the default 4MB buffer, but grubx64.efi is only 854800 bytes. The grubx64.efi is signed and can be verified by shim if booted locally. [lxiang@hostname tftpboot]$ pesign -i grubx64.efi -S --------------------------------------------- Content was not encrypted. Content is detached; signature cannot be verified. The signer's common name is Fedora Secure Boot Signer No signer email address. Signing time: Fri Dec 21, 2012 There were certs or crls included. --------------------------------------------- Version-Release number of selected component (if applicable): shim-unsigned-0.2-3.fc18 grub2-efi-2.00-15.fc18 How reproducible: Always Steps to Reproduce: 1. Configure DHCP and TFTP server. 2. Boot Actual results: Fetching Netboot image Invalid signature Verification failed Expected results: Shim boots grub. Additional info: I opened an upstream pull request https://github.com/mjg59/shim/pull/9. It works ok. Please review.
Forgot to mention, the Dell XPS 8500 doesn't really verify what it boots with PXE when doing Secure Boot. This also means I can "securely boot" anything through PXE, like a totally unsigned UEFI shell. After booting into shim-unsigned, the chain of secure boot is fine. This is just a heads-up for anyone trying to reproduce.
shim-signed-0.5-1.fc20,shim-0.5-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/shim-signed-0.5-1.fc20,shim-0.5-1.fc20
Package shim-signed-0.5-1.fc20, shim-0.5-1.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing shim-signed-0.5-1.fc20 shim-0.5-1.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-19954/shim-signed-0.5-1.fc20,shim-0.5-1.fc20 then log in and leave karma (feedback).
shim-0.7-1.fc20,shim-signed-0.7-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/shim-0.7-1.fc20,shim-signed-0.7-1.fc20
shim-0.7-1.fc20, shim-signed-0.7-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.