Re: trouble booting into staging kernel

["Fabio M. De Francesco" <fmdefrancesco@gmail.com>]

On Wednesday, October 12, 2022 10:22:06 PM CEST Deepak R Varma wrote:
> On Mon, Oct 10, 2022 at 01:25:56AM +0530, Deepak R Varma wrote:
> > On Sun, Oct 09, 2022 at 09:12:37PM +0200, Julia Lawall wrote:

[snip]
,
> I realized that working with the certificates is very complex. 

I entirely agree with you :-)

> > Create your own secure boot signing certificate without such an EKU, enroll 
it into either mok or db, and use it for signing.

Time ago the following documents from openSUSE finally helped me to understand 
how secure boot works and how to create and add my keys to boot custom kernels 
and modules:

https://en.opensuse.org/openSUSE:UEFI
https://doc.opensuse.org/documentation/leap/reference/html/book-reference/cha-uefi.html

After some time I realized that I don't need secure boot enabled when I boot 
my kernels and modules on several QEMU/KVM VMs (the guests) for testing 
patches. It's easier, faster, and I avoid the risk to hang or bring down the 
host, or worst, to corrupt the filesystems in the partitions of the "real" 
machine (the host) (these days my tasks are related to converting call sites 
which still uses old memory management API across the whole kernel, especially 
in file systems code).

This way I still have an host always booting with secure boot, and several 
VMs for testing patches for various archs (32 and 64 bits virtual machines).

I'd suggest to not disable secure boot in your host, since it's really useful 
for whoever cares security. Instead you should run custom kernels in VMs and 
just disable secure boot in guests.

Regards,

Fabio