[ShadowfetchStudio]

Planning only. Does not rebuild the ISO, does not change live-build, and does not invent Microsoft or Shadowfetch UEFI signing keys.

Tracking: issue 4 stays open. This PR is gate 0 of that checklist (land the plan on main). It does not authorize the Debian-chain spike, a claim change, or a merge of implementation work.

Why this note

The public known-issues page still lists unsigned Secure Boot (currently #18 on the 5.0 list; issue 4 still calls it “#1” from the 3.5 list). A numbering change is not a claim change. 4.0, 4.1, 5.0.0, and 5.0.1 all shipped after this track was named 3.6; none of them closed the caveat. 5.0.1 is APT-only, so a bootloader change cannot ride it.

Phoenix + Fireproof + grub-btrfs already shipped in 3.5.0 and remain the 5.0 contract. Secure Boot is the actual next trust-chain gap.

What landed in this PR

• next-release/3.6-secure-boot.md — engineering-honest plan, now on current main and aligned 1:1 with issue 4:
  • Non-negotiables copied from issue 4
  • 5.0.0 ISO baseline (4,085,778,432 bytes, squashfs 3,830,738,944, sha256 2d8a72e0…); 3.5.0 numbers kept as history
  • What 5.0 already did (per-machine DKMS MOK, shared-key scrub) vs what still needs a running Debian shim
  • Firmware-disable as the supported install path; MOK as a machine-local DKMS helper, not a substitute; optional Debian signed-chain reuse iff a lab spike passes
  • UKI as research, not a default
  • ISO-size math and squashfs/ESP headroom
  • Implementation gates table matching issue 4, with current state
  • Explicit out-of-scope list
  • Open items and Robert's decisions
• next-release/README.md — pointer updated for 5.0 and issue 4; existing 2.2.0 staged-binary notes kept

Branch note: repo rules block force-push on this head, so main was merged in rather than a published rebase. Local rebase onto main was clean (no file conflicts). Content conflicts were the stale 3.5.0 baseline vs 5.0.1.

No product claim on the website should change until a Secure-Boot-on test exists. The known-issues caveat stays published.

Still open / Robert

See the plan's last section. Short list:

• ESP contents on the 5.0.0 ISO still unmeasured (squashfs size is now in-tree)
• Debian-chain spike not authorized
• --removable vs NVRAM if the spike needs a BootXXXX entry
• Installed-only SB-on vs live USB still firmware-disable
• Publication / known-issues copy after a named gate
• Ship vehicle (keep “3.6” as a track name vs a later ISO)
• Microsoft third-party CA queue remains out of this track

Leave issue 4 open after this planning PR.

  

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 44d3e529-0d1c-49de-96ad-52a14617f877

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}