buildextend-live: drop shim fallback.efi from ISO; simplify EFI image #2435
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
UEFI boots from removable media via the arch-specific default EFI
application in /EFI/BOOT. When booted that way, shim chains to
fallback.efi if it exists, and fallback.efi creates an EFI boot entry.
That's not appropriate for removable media boot, since the media will
probably never be present again. If a TPM is present, fallback.efi will
additionally reboot the machine, and on some machines this leads to boot
loops. Instead of all this, we just want shim to chain directly to GRUB.
The EFI boot image currently looks like this:
EFI/BOOT/BOOTX64.EFI
EFI/BOOT/fbx64.efi
EFI/fedora/BOOTX64.CSV
EFI/fedora/fonts/
EFI/fedora/grub.cfg
EFI/fedora/grubx64.efi
EFI/fedora/mmx64.efi
EFI/fedora/shim.efi
EFI/fedora/shimx64.efi
Refactor the EFI boot image under the expectation that we never want to
create or boot from an EFI boot entry. Consolidate /EFI/<vendor-id> into
/EFI/BOOT and delete things we don't need: fallback.efi, its associated
CSV, and extra copies of shim. The result is this:
EFI/BOOT/BOOTX64.EFI
EFI/BOOT/fonts/
EFI/BOOT/grub.cfg
EFI/BOOT/grubx64.efi
EFI/BOOT/mmx64.efi
This also saves a couple MB of space.
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2004449
On UEFI systems, confirm that shim hasn't created an EFI boot entry during live ISO bootup.
This was referenced Sep 16, 2021
jlebon
approved these changes
Sep 16, 2021
| os.unlink(path) | ||
|
|
||
| # Drop vendor copies of shim; we already have it in BOOT*.EFI in | ||
| # BOOT |
There was a problem hiding this comment.
Should we sanity-check before nuking that BOOTX64.EFI and shimx86.efi are the same file?
There was a problem hiding this comment.
I don't think it matters. If the shim package decides to install a slightly different binary into BOOTX64.EFI, presumably that's the one we want to use. The shimx64.efi in the vendor directory is there for booting via a boot entry, which we won't be doing.
| [Service] | ||
| Type=oneshot | ||
| RemainAfterExit=yes | ||
| ExecStart=/bin/sh -c '! efibootmgr -v | grep -E "(HD|CDROM)\("' |
There was a problem hiding this comment.
Did you verify, even if manually, that this test failed before this PR?
jlebon
approved these changes
Sep 16, 2021
wanghao75
pushed a commit
to openeuler-mirror/nestos-assembler
that referenced
this pull request
Jun 25, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
UEFI boots from removable media via the arch-specific default EFI application in
/EFI/BOOT. When booted that way, shim chains to fallback.efi if it exists, and fallback.efi creates an EFI boot entry. That's not appropriate for removable media boot, since the media will probably never be present again. If a TPM is present, fallback.efi will additionally reboot the machine, and on some machines this leads to boot loops. Instead of all this, we just want shim to chain directly to GRUB.The EFI boot image currently looks like this:
Refactor the EFI boot image under the expectation that we never want to create or boot from an EFI boot entry. Consolidate
/EFI/<vendor-id>into/EFI/BOOTand delete things we don't need:fallback.efi, its associated CSV, and extra copies of shim. The result is this:This also saves a couple MB of space.
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2004449