codex-bot-andresmgsl/box
1
0
Fork 0
forked from heavy-duty/box
Code Pull requests Activity

fix: disable Secure Boot on box VMs — 'bad shim signature' hung every mint at GRUB

Browse source 
The console log finally showed the real error behind the GRUB-menu hang:

  error: prohibited by secure boot policy.
  error: bad shim signature.
  Failed to boot both default and fallback entries.

Incus defaults VMs to security.secureboot=true. A Debian cloud image
whose shim is signed with a key this host's OVMF does not trust then
fails signature verification, the kernel never loads, and the VM sits
at the GRUB menu forever — which is exactly the 5-min agent timeout on
every box. It worked in runs 11–15 on the old cached image and broke
the moment --purge-storage re-downloaded a build with a different shim.

security.secureboot=false on VM launch (cmd_new, and the drill's legacy
box). Secure Boot inside a throwaway box is not part of its threat
model — the VM boundary is — and off, it boots reliably across image
rebuilds. Container mode has no firmware and is unaffected.

Bare repro that isolated it: 'incus launch images:debian/13/cloud x --vm'
alone reproduced the hang, proving it was never the 0.5.0 code.
This commit is contained in:
claude-hdb 2026-07-14 17:05:39 +00:00
parent b9480fd9ce
commit 912e0621ca
2 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
bin/box
View file

@ -630,7 +630,14 @@ cmd_new() {
load_template "$t" load_template "$t"
m="$(pick_mode)" m="$(pick_mode)"
# shellcheck disable=SC2054 # "root,size=..." is a single incus argument # shellcheck disable=SC2054 # "root,size=..." is a single incus argument
if [ "$m" = vm ]; then extra+=(--vm --device "root,size=$T_DISK"); else extra+=(--config security.nesting=true); fi # security.secureboot=false: Incus defaults VMs to secureboot ON, and a
# Debian cloud image whose shim is signed with a key the host's OVMF does
# not trust dies with "bad shim signature / prohibited by secure boot
# policy" and drops to the GRUB menu forever — the kernel never loads. It
# is not part of a throwaway box's threat model (the VM boundary is), and
# turning it off boots reliably across image rebuilds. Container mode has
# no firmware, so it does not apply there.
if [ "$m" = vm ]; then extra+=(--vm --device "root,size=$T_DISK" --config security.secureboot=false); else extra+=(--config security.nesting=true); fi
# The template's identity is stamped ONTO the instance: which template, # The template's identity is stamped ONTO the instance: which template,
# which user. 'incus copy' preserves user.* keys (audit B2), so a clone # which user. 'incus copy' preserves user.* keys (audit B2), so a clone
# knows what it is without ever consulting the template again. # knows what it is without ever consulting the template again.

3
drill/drill.sh
View file

@ -779,7 +779,8 @@ else
# old stack, wearing the old tag. This is what migrate has to move. # old stack, wearing the old tag. This is what migrate has to move.
printf '\n minting a faithful legacy box on the old stack…\n' printf '\n minting a faithful legacy box on the old stack…\n'
if mint_legacy=$(incus launch images:debian/13/cloud legacybox --profile claude-dev \ if mint_legacy=$(incus launch images:debian/13/cloud legacybox --profile claude-dev \
--config user.claudebox=1 --vm --device root,size=20GiB 2>&1); then --config user.claudebox=1 --vm --device root,size=20GiB \
--config security.secureboot=false 2>&1); then
wait_box legacybox && ok "legacy box up on the old stack (claudenet, user.claudebox=1)" \ wait_box legacybox && ok "legacy box up on the old stack (claudenet, user.claudebox=1)" \
|| no "legacy box never came up — cannot drill migration" || no "legacy box never came up — cannot drill migration"
box list 2>/dev/null | grep -q '^legacybox' \ box list 2>/dev/null | grep -q '^legacybox' \