DRAFT
This is just a DRAFT. We try and make sure the information here is up to date and correct, but please check before depending on it.

What is Secure boot?

Secure boot is a setup using UEFI firmware to check cryptographic signatures on the bootloader and associated OS kernel to ensure they have not been tampered with or bypassed in the boot process.

Background

With the planned release of Windows 8, Microsoft has decided that all hardware that is marked "Windows 8 client ready" should:

Have secure boot enabled by default.

Allow a physically present user to disable secure boot in the firmware interface.

Ship the Microsoft keys in firmware.

Allow a physically present user to enroll their own keys in the firmware interface.

This means that Fedora as it stands booted on such hardware will refuse to boot until the user disables secure boot in the firmware.

How does it work?

Fedora and Secure Boot

As of yet (2012-06-04) Fedora has no approved plan for Secure Boot. Maintainers of the grub2, kernel and associated packages have proposed a plan where by Fedora will have Verisign (via Microsoft) sign a bootloader shim that will in turn boot grub2 (signed by a Fedora key) and the Fedora kernel (signed by a Fedora key) to allow out of the box booting on secure boot enabled hardware. Additionally, they will provide tools and information for users to create their own keys and sign their own copy of boot shim and grub2 and kernel (and whatever else they wish to sign). This plan has yet to be approved by the Fedora Engineering Steering Comittee.

Questions and Answers

Q: I think it would be much better if "Microsoft or UEFI or All hardware OEMs or The Government" would just "do X"

A: Feel free to contact any of the above and ask them to change their plans. Sadly, we can only work with the plans as we know them.

Q: Are you sure secure boot will be possible to disable in the firmware?

A: Yes, the Microsoft Windows 8 ready requirements require that to be the case.

Q: Can I remove the Microsoft key and use my own?

A: YES. According to the UEFI and Microsoft Windows 8 ready requirements you can remove all the keys and enroll your own. A Fedora Feature is being worked on to easily allow you to do this.

Q: Whats this about a $99 fee?

A: There is a one time fee of $99 to access the Microsoft sysdev portal in order to get your binaries signed by the Microsoft key (shipped by default in all Windows 8 ready devices).

Q: What if I want to build a custom kernel or load 3rd party kernel modules?

A: You will need to disable Secure boot, or setup your own keys and sign everything with them.

Q: What if I want to make a Fedora remix or distro based on Fedora?

A: If you ship the Fedora boot shim, grub2 and kernel unchanged, your remix or distro will boot on secure boot enabled machines (if the proposed plan is approved).

Q: what about ARM?

A: On ARM Microsoft Windows 8 ready requirements say that Secure boot should be enabled by default and cannot be disabled. Fedora has no plans to support secure boot on that platform and suggests buying Non Windows 8 ready hardware.

Q: Does this apply to servers too?

A: No. This is a Windows 8 client ready set of requirements. Servers will not have secure boot enabled by default.

Q: If I disable Secure boot, and I have a dual boot setup with Fedora and Windows 8, will Windows 8 boot ok?

A: Yes. Windows 8 will boot ok with Secure boot disabled.