fedora-qa

#855 multi-signed shim test day
Opened by mlewando. Modified

Open
Close Issue

We would like to organize a test day/week for booting shims that are signed by different Microsoft certs. In June 2026, Microsoft will no longer be able to sign shim with the 2011 key, and they have recently started signing new shim submissions with the 2011 and the 2023 keys.

The easiest way to deal with this change is to have one shim signed by both keys, but there is evidence that certain firmware does not honor a second shim signature. We would like to test different scenarios on various hardware so that we have a better understanding of its behavior.

We have three different installer images: one signed by only the 2023 key, one signed first by the 2011 and then by the 2023, and one signed first by the 2023 and then by the 2011. [1] We would like people, using diverse hardware when possible, to try to boot each of these and then report the results.

We also need the output of running the show-trusted.sh script, and hardware / firmware information.

Next week (15 - 19 Dec) could be the test week, and we might ask to repeat this again in January.

[1] https://pjones.fedorapeople.org/secureboot.test0.2025/

cc @pjones

Metadata Update from @kparal:
- Custom field story_points adjusted to 2
- Issue set to the milestone: Fedora 44
- Issue tagged with: test days

Sorry for a late response. We already have #852 and #853 running next week, adding a third one might be a bit too much. I would recommend delaying this to January, e.g. Jan 12-16th, or maybe Jan 5-9th (the attendance might be lower, though). Is it OK, or are you in a hurry?

Yeah, there is a lot going on next week. I think Jan 12-16 would be fine, but maybe we can start advertising earlier... because this is really important to get as much testing as possible.

thanks Kamil!

Ok, sounds good.

@jgroman @psklenar If one of you can take this ticket and work on it with Marta during the next week, that would be great. I believe it will be very similar to #853 , feel free to copy&paste most of it. A separate test case might again not even be needed. Thanks! I'm on vacation till January.

Metadata Update from @jgroman:
- Issue assigned to jgroman

Could someone please create a test day wiki page and a results page for this issue, like there are for #853 ? I am advertising this in other channels, and I would like to have a place where I can explain what testing options are available and where people can post their results.

thanks!

@jgroman, could you please create a wiki page and a results page for this test week? I would like to advertise this and have a place for people to put their results so that we can get as much testing as possible.
thanks & happy new year!

@mlewando Yes, sure, I'm on it!

Hi @mlewando ,

I've created:

https://fedoraproject.org/wiki/Test_Day:2026-01-12_Multi-signed_shim
https://testdays.fedoraproject.org/testday/12

On the wiki, please edit the page and update everything as you see fit. I have prepopulated some parts but feel free to edit those as well.

Items of notice:

  • The matrix channel / mailing list. If you have your own channel, it's best to funnel people there. If you don't, we can use our channels. Please be sure to join.
  • Names of developers involved, so that people know who to ping
  • Prerequisite for Test Day - how to download and write the image
  • Test cases in the test day - feel free to create a new testcase description in the wiki or find a testcase which could be reused for this purpose. I'll update testcase links in the test day for you.

After the start date is confirmed we would create QA calendar entry.

Hi @jgroman, thank you! I am filling in details to the wiki.

Could you please change a few things on the results page?
- change Profile to "Short system description, e.g. a desktop motherboard name, or laptop manufacturer + model name"
- remove the "netinst_" from all three columns

thanks!

We would like the run the test week next week, so please create the calendar entry. :)

Wiki and results page tweaked for readability

Calendar event added:
https://calendar.fedoraproject.org/QA/2026/1/12/#m11259

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/quality/tickets/issues/855

Please continue any further discussion there.
Metadata

test days

None
None
Low
2
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.