Re: [PATCH] Change "efi" to "EFI" in grub-mkrescue for secure boot

[Askar Safin]

---- On Sat, 07 Sep 2024 11:53:15 +0400 Vladimir 'phcoder' Serbinenko  wrote ---
 > > And main argument: I'm aware of one example when "EFI" is hard-coded in 
 > > signed secure boot GRUB binary. Debian has 4 signed GRUB binaries. All 
 > > they are generated 
 > > here:https://sources.debian.org/src/grub2/2.12-5/debian/build-efi-images/ 
 > > . One of them, grubx64.efi is created using "grub-mkimage ... -p 
 > > /EFI/debian".
 > Why do they use /EFI if it doesn't even work?

I will repeat: I tried to create GRUB .iso for my own uses. And I noticed that 
grub-mkrescue is incompatible with GRUB EFI binaries signed by Debian for 
reasons explained in my previous letter. But official Debian .iso images seem 
to be created without grub-mkrescue, and for this reason creators of official 
images didn't get these problems. So, /EFI *does* work for people who create 
official ISOs, they just don't use grub-mkrescue.

 > The question is who needs to change this

You mean should Debian change "EFI" to "efi" or GRUB change "efi" to "EFI"?

Of course, I want whole Linux ecosystem to converge to some single name, "efi" 
or "EFI". What should we choose? As I said in first letter, major distros 
(Debian, Ubuntu and Fedora) already use "EFI" in their ISOs. And at least one 
of them (Debian) hardcode "EFI" to signed binary. So, of course, GRUB should be 
changed, not distros. Because it is easier.

--
Askar Safin
https://types.pl/@safinaskar