Skip to main content

GRUB EFI for Confidential Computing

Go back to the list of events.

Before participating in this test event, please first read the GRUB EFI for Confidential Computing instructions (opens in a new tab) .

Test cases

Username Profile Fresh boot Comments
Short system description, e.g. a desktop motherboard name, or laptop manufacturer + model name
Jaroslav Groman
Gigabyte J3455N-D3H, Celeron J34455, 16 GB RAM, Fedora 45 20261023.n.0 Pass [1] [1] Tested with grub-cc-1:1-2, kernel 7.2.11-300
Josue Hernandez
KVM/QEMU VM, Fedora 45, UEFI + Secure Boot + TPM 2.0, 2 vCPU, 2 GB RAM 20 GB DISK Pass [1] [1] Completed successfully, it showed the UKI in the menu entry after reboot and booted successfully
Leandro Abdallah
KVM/QEMU VM, Fedora 45, UEFI + Secure Boot + TPM 2.0, 2 vCPU, 4 GB RAM 20 GB DISK Pass [1] [1] Completed the grub-cc fresh boot test successfully. Created a UEFI VM with Secure Boot and TPM 2.0, enrolled custom signing keys via MOK, built and signed a Unified Kernel Image (UKI) with ukify/pesign, installed grub-cc, signed it, and replaced the default grubx64.efi. After reboot, the GRUB menu showed the UKI entry and the system booted successfully using grub-cc. No Secure Boot violations or unexpected behavior observed.
Nicolas Frayer
F45 VM 2CPUs/4GB RAM/50GB HD Pass [1] [1] Followed the instructions, UKI entry visible in grub menu and it boots fine.
Rénich Bon Ćirić (renich)
QEMU 10.2.2 Q35 VM on Hetzner Cloud cpx42 (AMD EPYC-Genoa, 8 vCPU, 4 GB RAM, 20 GB Disk), Fedora 45 Cloud 20261023.n.0, UEFI (EDK II OVMF) + Secure Boot + TPM 2.0 (swtpm) Pass [1] [1] [Transparency note: Test executed autonomously by Gemini via Google Antigravity under the direct supervision of Rénich Bon Ćirić (FAS: renich)]. Tested on Fedora 45 Cloud Edition (20261023.n.0) with kernel-core-7.2.11-300.fc45.x86_64, grub-cc-1:1-2.fc45.x86_64, systemd-ukify-262-3.fc45.noarch, pesign-116-9.fc45.x86_64, mokutil-2:0.7.2-7.fc45.x86_64, and tpm2-tools-5.8-1.fc45.x86_64. Generated a custom RSA-2048 signing certificate via efikeygen/certutil and enrolled it into MOK via mokutil and MokManager. Built and signed two UKIs with ukify and pesign using identical kernel/initrd payloads but distinct embedded .cmdline sections, placed them in /boot/efi/EFI/Linux/, and created corresponding BLS entries in /boot/efi/loader/entries/. Signed grub-cc (noting that /usr/lib/efi/grub-cc/1:1-2.fc45/EFI/fedora/grubx64.efi ships with a pre-existing 'Red Hat Test Certificate' in Authenticode slot 0, and pesign -s appends the custom MOK signature in slot 1, which shimx64.efi validates cleanly) and installed it to /boot/efi/EFI/fedora/grubx64.efi. Verified in the grub-cc menu editor ('e') that entries use 'chainloader ($root)/EFI/Linux/kernel-7.2.11-300.fc45.x86_64-UKI*.efi' driven by the embedded (memdisk)/grub2/grub.cfg ('set timeout=5' / 'blscfg'). Both signed UKIs booted cleanly with Secure Boot enabled. bootctl status confirmed 'Secure Boot: enabled (user)', 'TPM2 Support: yes', 'Measured UKI: yes', and 'Measured OS: yes' via systemd-stub 262-3.fc45. Across reboots between the two different UKIs, tpm2_pcrread sha256 confirmed SHA-256 PCR8 remained unchanged (0x0000...0000), while PCR4 (0x0D8984... -> 0xE82994...), PCR9 (0x289D31... -> 0x1647E1...), and PCR11 (0x73843D... -> 0xD17C59...) updated as expected.
Rénich Bon Ćirić (renich)
Cherry Servers Bare-Metal Supermicro AS-2115GT-HNTR (AMD EPYC 9255 24C/48T Zen 5 Turin, SME/SEV-SNP/CCP 1022:156e, 192 GB DDR5, Dual 960 GB NVMe), Native Fedora 45 Cloud 20261023.n.0 (UEFI 2.90) + KVM/OVMF SecBoot + TPM 2.0 Pass [1] [1] [Transparency note: Second hardware run executed autonomously by Gemini via Google Antigravity under the direct supervision of Rénich Bon Ćirić (FAS: renich)]. Validated Fedora 45 Cloud Edition (20261023.n.0, kernel-core-7.2.11-300.fc45.x86_64, grub-cc-1:1-2.fc45.x86_64, systemd-ukify-262-3.fc45.noarch, pesign-116-9.fc45.x86_64, mokutil-2:0.7.2-7.fc45.x86_64, tpm2-tools-5.8-1.fc45.x86_64) on a Cherry Servers bare-metal Supermicro AS-2115GT-HNTR / H13SST-G server (AMD EPYC 9255 24C/48T Zen 5 Turin processor with hardware Confidential Computing capabilities SME, SEV, SEV-ES, SEV-SNP, VMPL, RMPQUERY in CPUID 0x8000001f and AMD Turin CCP/ASP 1022:156e) in two modes: (1) Native Bare-Metal UEFI 2.90 boot on /dev/nvme0n1: Installed Fedora 45 to the secondary NVMe drive, embedded Intel E810 DDP firmware (ice-1.3.43.0.pkg) and LACP 802.3ad bonding drivers into the initramfs, built and signed two UKIs (kernel-7.2.11-300.fc45.x86_64-UKI.efi and kernel-7.2.11-300.fc45.x86_64-UKI-alt.efi) with ukify and pesign, signed grub-cc (1:1-2.fc45), and booted the physical server via Boot0009 (\EFI\fedora\shimx64.efi -> grub-cc -> systemd-stub 262-3.fc45 -> Linux 7.2.11-300.fc45.x86_64). Verified live via bootctl status that GRUB 2.12 (grub-cc) chainloaded both UKIs on physical partition PARTUUID=3a62a530-78dc-420b-a79a-6153cc28f5ce. (2) Hardware-accelerated KVM (-accel kvm -cpu host) with OVMF Secure Boot + TPM 2.0 (swtpm) on the same EPYC 9255 host: Enrolled custom RSA-2048 MOK key via mokutil/MokManager, verified Secure Boot: enabled (user), Measured UKI: yes, Measured OS: yes, and confirmed across UKI reboots that SHA-256 PCR8 remained invariant (0x0000...0000) while PCR4 (0x1B9377... -> 0x4E855F...), PCR9 (0xFD3B03... -> 0xB8F029...), and PCR11 (0xEE0836... -> 0x99BA55...) updated as expected.
WQYeo
KVM/QEMU Q35 VM, Fedora 45 KDE, UEFI + Secure Boot + TPM 2.0, 4 vCPU, 4 GB RAM, 40 GB disk; Pass [1] [1] Completed the grub-cc fresh boot test successfully. Tested on kernel 7.2.11-300.fc45.x86_64 with grub-cc-1-2.fc45.x86_64. Enrolled a custom signing certificate using MOK, signed grub-cc, and built two signed UKI using the same kernel/initramfs, but with different embedded command lines. Both were booted successfully through grub-cc chainloader with secure boot on. SHA-256 PCR8 were unchanged between boots, while PCR11 changed and bootctl confirmed measured UKI/OS. No functional grub-cc failures are seen. Also, installed from Fedora-KDE-Desktop-Live-45-20261019.n.0.x86_64.iso, then updated (`dnf upgrade`) before running my tests.