Unable to boot with ventoy after shim update

[Macmill-340]

Installed fedora 39 workstation. During the system update my pc froze. so i forced shut down, after reboot everything seemed just fine. However, my usb drive with ventoy in it won't boot with secure boot turned on. I did some research and identified the issue is probably because of a shim version mismatch. Now whenever i try to boot into ventoy with secure boot turned on, it says: "verifyig shim sbat data failed: security policy violation. something has gone seriously wrong: sbat self check failed: security policy violation". only workaround is turning secure boot off. But how can i fix this?

[dennis-tseng99]

Hi Macmill, would you please check whether the sbat generation number of grub2 is smaller than NVRAM variable ?

[Macmill-340]

Hi Macmill, would you please check whether the sbat generation number of grub2 is smaller than NVRAM variable ?

Well, could you please describe the steps. Finding the sbat generation number is something I have not done before.

[dennis-tseng99]

For example:

step 1: show grub2 sbat entries
objcopy --only-section .sbat -O binary grub.efi /dev/stdout

step 2: show variable content (the exact path depends on your system)
cat /sys/firmware/efi/efivar/SbatLevel-xxx-xxx

step 3: compare both

[Macmill-340]

For example:

step 1: show grub2 sbat entries objcopy --only-section .sbat -O binary grub.efi /dev/stdout

step 2: show variable content (the exact path depends on your system) cat /sys/firmware/efi/efivar/SbatLevel-xxx-xxx

step 3: compare both

found this for the grub sbat entries "sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
grub,3,Free Software Foundation,grub,2.06,https//www.gnu.org/software/grub/
grub.rh,2,Red Hat,grub2,2.06-118.fc39,mailto:secalert@redhat.com"

and the variable content is "sbat,1,2021030218"

Other than this can't find anything else. The code for step one was not displaying anything. Please give a bit more detail.

[dennis-tseng99]

Just curious. Like you said: only workaround is turning secure boot off. That is to say you turned secure-boot off, and successfully booted your system. If it is true, then the content of variable will be something like this:

sbat,1,2024010900
shim,4
grub,3
grub.debian,4

[Macmill-340]

Just curious. Like you said: only workaround is turning secure boot off. That is to say you turned secure-boot off, and successfully booted your system. If it is true, then the content of variable will be something like this:

sbat,1,2024010900
shim,4
grub,3
grub.debian,4

Nope..did not need to turn secure boot off for booting into fedora as it has the latest shim package. Only when booting with ventoy. Even tried booting opensuse with secure boot turned on and it shows the same message mentioned above. Only workaround for booting other things that are not on same shim version(15.8 currently) is to turn secure boot off. Hope that makes sense.

ventoy/Ventoy#2692 you can see this page for reference.

https://en.opensuse.org/openSUSE:UEFI#Reset_SBAT_string_for_booting_to_old_shim_in_old_Leap_image and this is an opensuse forum instructing how to reset the sbat for booting into old shim

[xianax]

Same problem. Did you solve it ?

[Macmill-340]

Same problem. Did you solve it ?

Okay...so its working now apparently after a week of leaving it alone and not attempting to boot ventoy, and this happened today. So here is the thing, ventoy by default formats your usb drive in exfat format with mbr partition. Their website states that uefi firmware are upto somewhat compatible with mbr partitions. Therefore i've always used exfat+mbr despite having a gpt drive and uefi firmware. Today i decided to give it one more try but this time i reinstalled ventoy with exfat+gpt and decided to boot it up. And to my surprise the error message did not show up and it went straight to ventoy boot menu. I have no idea what happened. Nothing changed with my pc since the last time i tried and got the error message. To make sure the issue is gone i reinstalled ventoy with exfat+mbr again, reset my uefi settings to default and it worked too. I don't think formatting the usb drive with gpt was the solution but that is all i did. So now i am genuinely clueless but the issue is gone.

[xianax]

Okay...so its working now apparently after a week of leaving it alone and not attempting to boot ventoy, and this happened today. So here is the thing, ventoy by default formats your usb drive in exfat format with mbr partition. Their website states that uefi firmware are upto somewhat compatible with mbr partitions. Therefore i've always used exfat+mbr despite having a gpt drive and uefi firmware. Today i decided to give it one more try but this time i reinstalled ventoy with exfat+gpt and decided to boot it up. And to my surprise the error message did not show up and it went straight to ventoy boot menu. I have no idea what happened. Nothing changed with my pc since the last time i tried and got the error message. To make sure the issue is gone i reinstalled ventoy with exfat+mbr again, reset my uefi settings to default and it worked too. I don't think formatting the usb drive with gpt was the solution but that is all i did. So now i am genuinely clueless but the issue is gone.

Thank you bro! Your reply helped me a lot. I'll try it later.