Ezinsukwini ezimbalwa ezedlule, kwavela izindaba zokuthi ekupheleni kwale nyanga (Juni 2026), isitifiketi seMicrosoft esisetshenziselwa ukusayina ngedijithali ungqimba lwe-shim lwe-Linux sizofinyelela usuku lokuphelelwa yisikhathi. Njengoba lesi kuyisici esibalulekile esivumela ukusatshalaliswa kwe-Linux yesimanje (njenge-Fedora, Ubuntu, kanye ne-openSUSE) ukuthi kuqale izinhlelo ezine-UEFI Secure Boot evuliwe, kuyaqondakala ukuthi lezi zindaba ziphakamise ukukhathazeka okuthile. Kodwa-ke, abathuthukisi be-Fedora bebecacile kakhulu ngale ndaba: asikho isizathu sokwesaba; ikhompyutha yakho izoqhubeka nokuqalisa ngokujwayelekile.
Ukuze uqonde ukuthi kungani kungeke kube nokuvalwa okukhulu kwe-Linux, kubalulekile ukuqonda ukuthi uchungechunge lokuthembela lusebenza kanjani. Ngesikhathi senqubo yokuqalisa, uhlelo lwe-UEFI aluhloli ukuthi isitifiketi siphelelwe yisikhathi, njengoba ukukhathazeka kwalo kuphela ukuqinisekisa ukuthi isiginesha ye-cryptographic iyasebenza nokuthi ukhiye awukasuswanga ngokusobala ngenxa yokuyekethisa. Ukuphelelwa yisikhathi kwesitifiketi sika-2011 kusho ukuthi iMicrosoft ngeke isakwazi ukusisebenzisa ukusayina izinguqulo ezintsha ze-bootloader.
Ukushintshela kukhiye omusha ka-2023
Ukuze kugcinwe ukuhambisana nokuqinisekisa ukuthi izinhlelo ze-Linux zingafakwa kwihadiwe yesimanje, iMicrosoft ikhiqize isitifiketi esisha ngo-2023. Ukushintshela kule nkinobho entsha kuklanyelwe ukuba kungabonakali ngokuphelele kumsebenzisi.
Njengamanje, izindawo zokugcina ezifana neFedora Rawhide (isisekelo seFedora 45 ezayo) sezivele zifaka umphathi we-shim boot osayinwe kabili . Lokhu kusho ukuthi iqinisekiswe yizinkinobho zika-2011 no-2023, okuqinisekisa ukuhambisana namakhompyutha amadala angawazi ukhiye omusha kanye namabhodi ebhodi esimanje asevele efakiwe. Ekugcineni, izinguqulo zesikhathi esizayo ze-shim zizosayinwa kuphela ngokhiye ka-2023.
Ubuthakathaka bangempela: Ingozi ilele kukhodi endala
Okungavimbela uhlelo ukuthi luqalise ukusebenza akukhona ukuphelelwa yisikhathi, kodwa ukuhoxiswa nge-UEFI Certificate Revocation List (eyaziwa ngokuthi i-DBX). Imibiko yezokuphepha isanda kushicilela imininingwane ngobungozi obubili obubalulekile (i-CVE-2026-8863 kanye ne-CVE-2026-10797) obuvumela umhlaseli ukuthi asebenzise ikhodi enonya ngokugwema ukuvikelwa kwe-Secure Boot.
Ngenhlanhla, lobu buthakathaka buthinta kuphela izinguqulo ezindala kakhulu ze-shim (inguqulo 0.9 nangaphambilini, eyadalwa ngaphambi kuka-2016). Amasignesha alezi zingqimba ezisengozini angeziwe kusizindalwazi samasignesha angavunyelwe (i-DBX). Uma unesistimu esiphelelwe yisikhathi kakhulu (njenge-CentOS 7.2 noma i-RHEL 7.2) futhi isizindalwazi sakho se-UEFI sibuyekeziwe, ikhompyutha yakho izohluleka ukuqala ngenxa yezizathu zokuphepha.
Yini okufanele uyenze (futhi yini okungafanele uyenze)?
Nakuba ukuphelelwa yisikhathi kungeke kuphule uhlelo lwakho lwamanje, abathuthukisi batusa kakhulu ukuthi ubuyekeze isizindalwazi sokhiye se-firmware yakho ukuze uthole ukhiye omusha ka-2023 futhi uvikeleke esikhathini esizayo. Nansi imiyalo yokuhlola isimo sedivayisi yakho:
Hlola ukuthi usebenzisa i-UEFI noma i-BIOS (Ifa):
[[ -d /sys/firmware/efi ]] || echo BIOS
Hlola ukuthi i-Secure Boot ivuliwe yini:
mokutil --sb-state
Bhala okhiye bomphakathi ku-firmware:
mokutil --db --short (Lapha kufanele ubone ukhiye ka-2011, futhi uma usesikhathini, ukhiye ka-2023).
Buyekeza i-firmware yakho kanye nezinkinobho ngokuzenzakalelayo:
sudo fwupdmgr update (Landa izibuyekezo ezivela ku-Linux Vendor Firmware Service).
Qinisekisa ukuthi iyiphi ikhiye i-shim yakho esayinwe ngayo (idinga iphakheji ye-pesign):
sudo pesign -S -i /boot/efi/EFI/fedora/shimx64.efi
Okokugcina, kufanelekile ukusho ukuthi abathuthukisi beFedora bakhiphe isexwayiso:
Uma unesithakazelo sokufunda okwengeziwe, ungathola imininingwane kusixhumanisi esilandelayo.