Bug#1052299: gnome-boxes: Cannot install "GNOME OS Nightly" - secure-boot set by ovmf while gnome os efi seems not signed

[Jeremy Bícha]

Control: forwarded -1
https://gitlab.gnome.org/GNOME/gnome-build-meta/-/issues/732

On Wed, Sep 20, 2023 at 12:00 AM Alban Browaeys <prahal at yahoo.com> wrote:
> If I attempt to create a GNOME OS guest I end up on the edkII console.
> If inhte console I try to boot the EFI (in FS0: be it bootx64.efi in
> \EFI\BOOT or systemd-bootx64.efi in EFI\systemd) I get a "Command Error
> Status: Access Denied" error.
>
> I got he clue it might be secure boot related by https://forum.proxmox.com/threads/vm-always-going-into-uefi-interactive-shell.119215/
>
> I also learned that the install was fine with the flatpak, so I compared
> the VM configurations for GNOME OS:

Thank you for your thorough bug report. As a workaround, I am
disabling Secure Boot in GNOME Boxes now (cherry-picking a future
GNOME Boxes 46 change). I cloned this bug for that change.

I believe ultimately a major problem here is that the GNOME OS images
are not adequately signed for Secure Boot yet. I found an issue
upstream that seems to talk about fixing that issue.

Thank you,
Jeremy Bícha