I finally updated the firmware to the latest firmware, FCKT99AUS of 11/18/2020. The dual-signed shim fails on it as well and I went back to the 2023 single-signed shim and secure boot is working again. I have updated the Wiki for this version.
I did the fwupdate steps as the new keys were no longer installed. As before the primary keys did update but the KEK key did not. I suspect this firmware will never support the dual-signed shim. Are there any plans to make a single-signed shim package available? While I can copy the single-signed shim over each time shim-signed is updated or GRUB reinstalled, that might get a bit annoying a few years down the road when I forget all of this! That is the TL;DR Lenovo, in its "wisdom" offers at least three different methods of firmware updates. I chose the ISO method and the instructions state to write it to a CD and boot. Mounting the ISO and looking at it revealed that there were no DOS files in its root directory. However, there is a .img file that is a complete bootable DOS image with the firmware update utility, but the instructions state nothing about it. In short, I wasted a CD-R. I found instructions to copy the .img file out of the ISO file and wrote it to USB media. After a few attempts I saw that I was trying UEFI only boot. Once I enabled CSM and Legacy Boot the firmware update was successful. Of course, now I could no longer boot into Debian (the only OS installed). That led to writing the latest netinst image to the USB stick and managing to boot it in UEFI mode. After choosing Rescue Mode, running efibootmgr in the chroot gave the error message "EFI variables are not supported on this system" A bit of searching later I discovered I had to mount the efivarfs using: mount -t efivarfs efivarfs /sys/firmware/efi/efivars Then efibootmgr listed the UEFI boot devices. A bit more searching revealed that I needed to reinstall GRUB as: grub-install /dev/sda --target=x86_64-efi --efi-directory=/boot/efi Finally debian was listed in the boot order and I was able to successfully boot into the installed system and test Secure Boot. Hopefully, this might help someone running into a similar situation. - Nate -- "The optimist proclaims that we live in the best of all possible worlds. The pessimist fears this is true." Web: https://www.n0nb.us Projects: https://github.com/N0NB GPG fingerprint: 82D6 4F6B 0E67 CD41 F689 BBA6 FB2C 5130 D55A 8819
signature.asc
Description: PGP signature
