Hi Stephan! On Mon, Jul 20, 2026 at 11:50:22AM +0200, Stephan Verbücheln wrote: >Package: shim >Version: 16.1-2~deb13u1 > >Since a new test was added to fwupdmgr with the last update, it now >reports on machines with UEFI Secure Boot that the device security >level is only basic (HSI-1): > >$ fwupdmgr security >[...] >HSI-2 >[...] >✘ UEFI memory protection: Disabled >[...] > >I suspect that this is caused by the fact that the shim and grub >binaries are not built with the flag NX_COMPAT.
Nod. This was a deliberate decision for Trixie (and Bookworm). To add NX, we need a complete NX-capable boot chain firmware -> shim -> grub -> linux. We don't have that in Trixie, so I didn't enable NX there. When you upgrade to forky, the complete chain is NX-compatible and is tagged as such. -- Steve McIntyre, Cambridge, UK. [email protected] “Rarely is anyone thanked for the work they did to prevent the disaster that didn’t happen.” -- Mikko Hypponen (https://twitter.com/mikko/)
