Linux users face a Microsoft Secure Boot headache - here's the painkiller

[Condobloke]

Linux users face a Microsoft Secure Boot headache - here's the painkiller

Secure Boot has always been a nuisance for Linux users, but now that Microsoft's 2011 certificate authorities are expiring, it's become a real pain.

www.zdnet.com

Secure Boot has always been a nuisance for Linux users, but now that Microsoft's 2011 certificate authorities are expiring, it's become a real pain.
Read the article It is not a sign to assume panic stations.
There is a paragraph at the bottom of the article which says:
For you, the simplest test is also the most practical:

• Download a current ISO from your distro and write it to a USB stick.
• On a machine with Secure Boot enabled, and the firmware freshly updated, try booting with the USB stick.
• If it works cleanly, your combination of firmware keys and distro signing is OK, and you're good to go.

Do this test once now, so you know what the new normal looks like. If a future image fails to boot with Secure Boot enabled, you'll be able to tell whether the regression is in the firmware (keys not updated), the distro's image, or a nasty interaction between the two.

(Note: the firmware for my asrock board has no firmware update available. it made no difference to my passing the above test)

 

[Condobloke]

The nutshell is this: If you have always installed all updates in a timely manner, then this paragraph will be of comfort:
Most mainstream Linux distributions have already considered the 2026 expiration and concluded that it is not an emergency but something to address carefully.
Further to the above is the below:

Many distributions are aligning their shim builds and signing processes to remain compatible throughout the transition. If you're on a modern release of a big‑name distro and your firmware is up‑to‑date, chances are high that "it just works" will continue to be true.

So, keep your cool.

if you have been ignoring certain updates because you have felt you don't need all that crap etc etc, you may wish to rethink that.

The very worst outcome?, is probably a complete fresh installation, with Secure Boot Enabled.