almalinux-deploy VS shim-review

Running another 8.x? Move to AlmaLinux using almalinux-deploy.

I mention that because you had to be at CentOS 8 latest, and since CentOS is now a stinkin pile of nothingness, there are adjustments path wise to point at Alma's capture of that in order to prep to make the jump. I think all that is documented here: https://github.com/AlmaLinux/almalinux-deploy

You can also convert an Oracle Cloud to Alma or Rocky then install ApisCP. If you do, append -s has_low_memory=1 to the installer.

If going with Oracle Linux it's necessary to convert to Alma or Rocky before installing the 30-day trial. This also doubles as a great hack for a free 1 GB DNS-only server.

Just follow those steps to migrate centos to almalinux: https://github.com/AlmaLinux/almalinux-deploy

I understand from here that it is recommended to update to CentOS 8.5. I have carefully inspected the recommended approaches from the README and this issue and attempted to cobble together something that I believe should work but I am facing some issues.

I used the Almalinux deploy script to switch to Alma.

A version of our Open Source hosting control panel (BlueOnyx 5210R) was initially shipped with CentOS 8 as base OS before we switched the installation media to AlmaLinux. Those that were still running CentOS 8 were informed via the GUI to convert to AlmaLinux by running the AlmaLinux conversion script that we had bundled with an update or ours.

Thanks for the questions. We already have several migration options. If you're currently on CentOS 8 or any other EL8 you can use this: https://github.com/AlmaLinux/almalinux-deploy. If you are on CentOS 7.x you can use our ELevate project: https://almalinux.org/elevate.

Alma used CloudLinux's secure boot key (among other CloudLinux infrastructure / resources) for their first few releases.

Rocky Linux didn't have secure boot out the gate because we built everything from scratch, which included going through the long process of getting our own secure boot key approved / signed by Microsoft. See https://github.com/rhboot/shim-review/issues/194 (Alma didn't get their own until https://github.com/rhboot/shim-review/issues/235)

AlmaLinux uses their own secure boot certificate, as noted in their last shim-review: https://github.com/rhboot/shim-review/issues/235

In my opinion, this news is exaggerated.

The 3rd party UEFI CA key is implemented by the Shim, which is an attack vector. To be certified by default for the shim, the workflow is a github issue [0]. This is not necessarily bad, but a vector for social-engineering and more.

If an attacker is signed by the shim, he can execute trusted code on most machines without problems.

IMO it is better to leave this choice to the user to take this risk and enable the shim. Who installs linux should make this choice consciously

[0]: https://github.com/rhboot/shim-review

Translated with www.DeepL.com/Translator (free version)

Most if not everything else is in place for when this process is complete, but this single step (https://github.com/rhboot/shim-review/issues/194) is a blocker on it.

Hey. Secureboot should be ready soon. You can follow along at home here: https://github.com/rhboot/shim-review/issues/152. We are basically just waiting for the shim to be signed.

And it seems that since well over two months, Microsoft is just busy changing their review process and not signing anything at all.