rocky-tools VS shim-review

Rocky Linux has migration scripts available at https://github.com/rocky-linux/rocky-tools/tree/main/migrate...

An easy shortcut though, in case you have to hand type it out somewhere, is https://rockylinux.org/migrate2rocky.sh

We have a conversion script for 9 here.

https://docs.rockylinux.org/guides/migrate2rocky/ https://github.com/rocky-linux/rocky-tools/tree/main/migrate2rocky

I used Rocky Linux to migrate the CentOS 8 Servers, the migration was just done using the migrate2rocky.sh script from https://github.com/rocky-linux/rocky-tools/tree/main/migrate2rocky.

You can also convert an Oracle Cloud to Alma or Rocky then install ApisCP. If you do, append -s has_low_memory=1 to the installer.

If going with Oracle Linux it's necessary to convert to Alma or Rocky before installing the 30-day trial. This also doubles as a great hack for a free 1 GB DNS-only server.

I run the migration script today and I encountered this pellicular error:

migrate2rocky.sh is a 1200 line bash script that appears to call dnf dozens of times. Granted, at the time he didn't know exactly what the migration path was going to look like, so call this one a broken promise rather than a false statement.

It's covered in Rocky's docs and the migrate2rocky README, relevant excerpt here:

Alma used CloudLinux's secure boot key (among other CloudLinux infrastructure / resources) for their first few releases.

Rocky Linux didn't have secure boot out the gate because we built everything from scratch, which included going through the long process of getting our own secure boot key approved / signed by Microsoft. See https://github.com/rhboot/shim-review/issues/194 (Alma didn't get their own until https://github.com/rhboot/shim-review/issues/235)

AlmaLinux uses their own secure boot certificate, as noted in their last shim-review: https://github.com/rhboot/shim-review/issues/235

In my opinion, this news is exaggerated.

The 3rd party UEFI CA key is implemented by the Shim, which is an attack vector. To be certified by default for the shim, the workflow is a github issue [0]. This is not necessarily bad, but a vector for social-engineering and more.

If an attacker is signed by the shim, he can execute trusted code on most machines without problems.

IMO it is better to leave this choice to the user to take this risk and enable the shim. Who installs linux should make this choice consciously

[0]: https://github.com/rhboot/shim-review

Translated with www.DeepL.com/Translator (free version)

Most if not everything else is in place for when this process is complete, but this single step (https://github.com/rhboot/shim-review/issues/194) is a blocker on it.

Hey. Secureboot should be ready soon. You can follow along at home here: https://github.com/rhboot/shim-review/issues/152. We are basically just waiting for the shim to be signed.

And it seems that since well over two months, Microsoft is just busy changing their review process and not signing anything at all.