Shim-14 won't boot on Asus Z97 with secure boot enabled.

[TBOpen]

Just reporting, may want to test out Shim-15.

Prior known working shim is 0.9 on that mobo. I don't have access to it, remote system/user.

[nessdoor]

Bug reproduced.

Neither Shim 14 nor Shim at commit 237b7d9 seem to boot properly, but 0.9 succeeds (after some annoying but bug-unrelated build issues).

If you haven't found a solution yet, I think I'll proceed with a very long git bisect(unless you're already on it).

[nessdoor]

Nevermind, I did it anyway.

This is the git bisect log output:

git bisect start
# bad: [237b7d97b208e89aace2c86ade82dcba86986e6f] Add some *more* TODO tasks.
git bisect bad 237b7d97b208e89aace2c86ade82dcba86986e6f
# good: [c340e8ce10ada28b30927e703cb62e9368cc1b9d] 0.9
git bisect good c340e8ce10ada28b30927e703cb62e9368cc1b9d
# good: [96b347c200b2401d02f576b47da8a49cc6286b4b] Add a mechanism to print openssl errors
git bisect good 96b347c200b2401d02f576b47da8a49cc6286b4b
# bad: [01b5d9c6b216991b3d31bb2fd281553dd221978e] MokManager: Lindent (and other reformats) the whole file.
git bisect bad 01b5d9c6b216991b3d31bb2fd281553dd221978e
# bad: [bc3b6525d898e130e1e9fbfe76e2f4d890e49148] Cryptlib: replace CryptPem with CryptPemNull
git bisect bad bc3b6525d898e130e1e9fbfe76e2f4d890e49148
# bad: [35fd2c170cadfd50670d55fbcbf9cb2f4d4f1868] Don't build shim_cert.h in parallel with other targets.
git bisect bad 35fd2c170cadfd50670d55fbcbf9cb2f4d4f1868
# good: [70d49e332d0196a15f19cbc7c603b01057e3e901] Cryptlib: Remove MD4
git bisect good 70d49e332d0196a15f19cbc7c603b01057e3e901
# good: [19a7e1bcd561d735ed41d22e12679e70f5c90b1c] Add some defaults and a syntastic file so vim helps more.
git bisect good 19a7e1bcd561d735ed41d22e12679e70f5c90b1c
# bad: [25f6fd08cd2652536371308e5d38ab4baadf6783] try to show errors more usefully.
git bisect bad 25f6fd08cd2652536371308e5d38ab4baadf6783
# good: [00753a0a288dec5a8d7ccdb6290bbd6a306059a6] Add some debugging data to the last malformed binary check...
git bisect good 00753a0a288dec5a8d7ccdb6290bbd6a306059a6
# first bad commit: [25f6fd08cd2652536371308e5d38ab4baadf6783] try to show errors more usefully.

So, apparently, something happened in commit 25f6fd0 but, not being an EFI application developer myself, I really can't say a thing about what (and if something really) has gone wrong where.

[todoleza]

I ran to this issue with shim-signed-15-2 after upgrade to Fedora 28.
I tried upgrading bios to new version, but that didn't help either. Both new bios v3502 from 2018/04/26 and older v2702 from 2015/11/23 ended up with black screen and seemingly idle CPU. Experienced on Asus Z97-DELUXE/USB 3.1 rev.1.xx.
Shim-13 from Fedora 27 is working well.
I offer help with testing if needed.
My workaround was to downgrade shim and/or add new EFI entry with old shim.efi binary that is renamed from what is shipped in rpm. E.g. efibootmgr -c --disk /dev/sdc --part 3 --loader /EFI/fedora/shim-old.efi --label 'Fedora-oldshim'

[vathpela]

Can you try this with https://pjones.fedorapeople.org/shimx64.efi ? I believe there's a good chance this should work again in that build. You'll also need https://pjones.fedorapeople.org/mmx64.efi , as this build has the RHEL public keys enrolled, rather than the Fedora ones.