Paul Meyer
6f2f5b96f1
CoCo firmware is stateless, so Secure Boot keys cannot be enrolled at runtime: it only enforces Secure Boot with keys baked in at build time, refusing unsigned images from the first boot. The default exclusion of the enrolled-keys firmware feature hence keeps unsigned images bootable, but it also makes firmware discovery fail on distros that only ship SNP/TDX firmware with pre-enrolled keys (e.g. Fedora's TDVF). Drop the rejection of --secure-boot=yes with --coco= and instead treat it as an opt-in to such firmware, by lifting the enrolled-keys exclusion. While at it, reject --efi-nvram-template= and an explicit --efi-nvram-state= path with --coco=, which were silently ignored, as stateless firmware has no NVRAM to instantiate or persist. Signed-off-by: Paul Meyer <katexochen0@gmail.com>
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release