From 18d3f4461c0fc83cd62c28122b966fd4d068018b Mon Sep 17 00:00:00 2001 From: Mathieu Benoit Date: Tue, 28 Jul 2026 05:49:28 +0000 Subject: [PATCH] [FIX] script qemu: disable UEFI Secure Boot (Arch boot) OVMF Secure Boot rejected Arch's unsigned GRUB with "Access Denied" -> "No bootable option" -> dropped to the firmware menu, never booted. Disable Secure Boot in the UEFI boot (firmware.feature secure-boot=no): Arch now boots and cloud-init applies user/password/hostname/ssh-key (console login erplibre/erplibre works). Ubuntu/Debian/Fedora also boot without Secure Boot (their signed shim is not required), no regression. Note: Arch networking (eth0 stays down, cloud-init does not finish) is still under investigation and tracked separately. Co-Authored-By: Claude Opus 4.8 (1M context) --- script/qemu/deploy_qemu.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/script/qemu/deploy_qemu.py b/script/qemu/deploy_qemu.py index 0407493..19c15b6 100755 --- a/script/qemu/deploy_qemu.py +++ b/script/qemu/deploy_qemu.py @@ -1001,8 +1001,15 @@ def virt_install( # n'embarquent plus le chargeur BIOS/GRUB-pc et partent en boucle # « Booting... » en SeaBIOS. UEFI (OVMF) fonctionne pour Ubuntu/Debian/ # Fedora. --bios force l'ancien BIOS si OVMF est indisponible. + # Secure Boot DÉSACTIVÉ : le chargeur d'Arch (GRUB) n'est pas signé et + # OVMF Secure Boot le refuse (« Access Denied » -> pas de boot). Ubuntu/ + # Debian/Fedora bootent aussi sans Secure Boot (shim signé non requis). if not args.bios: - cmd += ["--boot", "uefi"] + cmd += [ + "--boot", + "uefi,firmware.feature0.name=secure-boot," + "firmware.feature0.enabled=no", + ] if not args.attach_console: cmd.append("--noautoconsole") runner.run(cmd, privileged=True)