Debian Fixes Secure Boot For 64-bit ARM After Being Broken For Two Years

While Debian and its derivatives are quite popular with ARM single board computers, the ARM64 Secure Boot support has been broken for at least two years. But a fix is on the way and it should appear for this year's Debian 12 "Bookworm" release.

Since at least May 2021, Debian's ARM64 build has featured broken Secure Boot support. In particular, this bug has taken the light in recent weeks for noting the breakage with the shim signed by Microsoft and the GRUB2 bootloader signed by Debian.

The fix is a new patch by cherry-picking some parts from upstream GRUB2 around loading ARM with Secure Boot enabled. That patch in turn should work its way into Debian 12.0 Bookworm -- currently it's waiting on approval given the Bookworm freeze.

There is now a call for testing for verifying Debian's ARM64 Secure Boot support when using the latest Debian signed shim and GRUB2 packages.