Migrating from lanzaboote to limine secure boot

Help
1

Hi everyone, I am trying to migrate from lanzaboote to limine secure boot.

I first followed the Disable Secure Boot guide from lanzaboote, with cleaning up the EFI/Linux directory. Then I followed the Secure Boot setup guide for limine from the wiki.

Now that when I reboot the system, I get the warning message Invalid Signature detected twice from UEFI, pressing enter twice will get me to limine bootloader and booting the system without problem.

I then checked with sbctl verify that both EFI/BOOT/BOOTX64.EFI and EFI/systemd/systemd-bootx64.efi are not signed. Moving them out from ESP dose make the warning go away.

But now I wonder is it safe to move those efi executables out from ESP? Or is there any better way to handle this?

Thanks.

2

Hi,

@yushi curious why wanting to move from lanzaboote to limine secure boot? And did you find how to successfully migrate, eliminate warnings, and get everything working?

Thanks.

4

If you followed all the steps, including using bootctl to generate new keys, then these old EFI binaries are signed with the old key and will generate a warning.

I think these are safe to move, as these are the leftover lanzaboote/systemd-boot EFI stubs.
Worst case scenario is you have to disable SB, boot from USB and move them back in place.

5

If you have no other system, you can try something riskier to clean up the boot.

sudo rm -fr EFI/*
nixos-rebuild --sudo --flake .#"host" boot --install-bootloader
6

As I remember, I just nuked the whole EFI partitiion after backing it up as @zendo said since I only have NixOS installed.