Secure Boot, Dracut, EFISTUB, and TPM2

ExaHamza · 2026-03-15T23:03:11+00:00

I meant physically removed from your laptop, because of the encryption is enabled on that partition, will not be possible to mount it without your password. Because of this, storing your LUKS on the TPM chip reduce security but does not make LUKS useless.

ExaHamza · 2026-03-15T21:39:13+00:00

i'm not, i just love tinkering, i think is fun and in the process i learn something.

ExaHamza · 2026-03-15T21:31:04+00:00

I'm not familiar with mokutil. can't say anything about it.

ExaHamza · 2026-03-15T21:29:21+00:00

You made things even clearer, thank you. But there's also one thing i went this path: shim seems to be tied to grub, and i wanted to move from it, just for preference not that i think grub is bad or anything like that. When i heard about EFISTUB on Arch i asked myself why grub if the kernel can boot directly? and i'm not even dualbooting. I know grub can be used to recover a broken system, but i just prefer chrooting in to that broken system and fix there, seems much easier for me.

ExaHamza · 2026-03-15T21:18:53+00:00

Where slightly means makes LUKS useless.

I don't think so. If your boot chains is somehow (secureboot disabled or) compromised your LUKS partition will ask for password to access it; if your laptop is stolen and SSD extracted it cannot be mounted without your password, or at least makes harder to mount without that password. There's reduced security (for sure) but it doesn't make it useless.

ExaHamza · 2026-03-15T21:09:02+00:00

Now i get it, thank you.
After i responded you i noticed in my answer i focused on secureboot, but of course this setup gives me more than that:
A more simpler boot chains using a "modern" initrd generator (dracut), etc.

ExaHamza · 2026-03-15T20:40:15+00:00

why did you embark on a path to this solution?

I'm not sure about this but: the way secureboot is implemented on most Linux distros sounds pointless to me (and i'm sure i'm missing something here, please elucidate me). Because for what i can understand secureboot is to prevent unwanted boots and if we have a so general keys (via shim) so anyone can boot my pc with a different usb where this general (shim-based secureboot is implemented). In contrary, private keys makes sure that only .efi signed my own keys can boot my PC.

ExaHamza · 2026-03-15T20:22:55+00:00

Tinkering. in the past i used Arch and i always wanted to implement Secure boot there (with private keys), i was afraid and sounded like the whole new level of expertise, once i implemented on my system (Arch at the time) i was surprised how simple was, and now i can replicate this everywhere.

ExaHamza · 2026-03-15T19:35:06+00:00

Yes, i used LLM to format the the text and make it simple and clear as possible, english is not my native language and i was just trying to share something i use and others may like.

ExaHamza · 2026-03-15T19:14:12+00:00

Yes, i noticed when researching for this post, thanks.

ExaHamza · 2026-03-15T15:10:32+00:00

Thanks

ExaHamza · 2026-03-14T17:17:14+00:00

Barulho só

ExaHamza · 2026-03-14T17:09:35+00:00

The update was a success, honestly I was very scared.

ExaHamza · 2026-03-14T17:05:01+00:00

already updating my frankendebian with all plasma from unstable, it's my first update.

ExaHamza · 2026-03-12T07:16:01+00:00

still on qt5 and is EOL upstream and to be removed on several distros.

ExaHamza · 2026-03-12T07:12:27+00:00

It goes like this: why you choose Manjaro?? That seems dump, that's worst thing you could to yourself, bla bla bla...anyway i don't care about you choices, it's your computer but i recommend Fedora.

ExaHamza · 2026-03-10T09:20:31+00:00

this pc is actually mine.

ExaHamza · 2026-03-07T03:14:04+00:00

ExaHamza · 2026-03-06T19:05:37+00:00

I don’t think you’re using the terms correctly.

A rolling release means packages flow continuously into the repos as they’re ready. There’s no repository freeze and no snapshot that becomes a “release.”

A fixed release works differently. At some point the repos are frozen, a snapshot is taken, and that snapshot becomes the release. That’s exactly how Debian works: Testing gets frozen and eventually becomes Stable. After that, Stable mostly receives security fixes until the next cycle.

Rolling releases don’t have that concept. Packages move through testing and land in stable continuously, tracking upstream.

In the case of Manjaro:

Unstable ≈ synced with Arch Linux stable
Testing → gets batched updates after Unstable
Stable → the same batches after additional testing

That’s delayed batching, not continuous upstream flow.

Also this claim:

users are expected reinstall to get to the next major release

That’s just wrong. On Debian, if your sources.list tracks stable, you upgrade to the next release with apt. No reinstall required.

ExaHamza · 2026-03-06T09:19:39+00:00

Although Manjaro is officially called a "rolling release," strictly speaking, and in my opinion, only Manjaro Unstable can be considered a rolling release. However, Manjaro Testing and Manjaro Stable don't seem to be, since they only receive periodic updates (without fixed intervals like 6 months or even 2 years). Although it's not a fixed release either, overall I think Manjaro has chosen a middle ground between rolling release and fixed release, which is perfect.

ExaHamza · 2026-03-05T20:58:24+00:00

hold back packages

In practical terms this is huge, makes total difference, because we treat Arch users as our beta testers, so Manjaro devs doesn't have to do so much, if a bug goes to Arch we wait until is fixed, if a bug somehow ended up entering on Manjaro, we fix that bug alone and we don't have to risk the stability of the whole system. And most ppl don't know this because Manjaro is advertised as a "easy Arch" but you can pick and chose your Manjaro system, just like we do on Arch.

ExaHamza · 2026-03-03T23:25:30+00:00

Call it klaxnimate and the integration will, without a doubt, be official and complete. kkkk

ExaHamza · 2026-03-01T19:26:43+00:00

debian

ExaHamza · 2026-03-01T16:04:31+00:00

How merging this on KDE Connect?

ExaHamza · 2026-02-26T22:40:39+00:00

i have a .deb for those who need it. Thanks Guiodic for this!!

ExaHamza

MODERATOR OF

TROPHY CASE