The problem is that Microsoft started all this at the outset of Windows 8. The problem lies in the fact that Microsoft, a corporation, not an independent entity, is responsible for certifying SB keys (SBAT).
It has been shown that GNU/Linux had to circumvent the Secure Boot issue by writing shims (efi.32-bit, efi.64-bit) that could be accepted by Secure Boot. I think Fedora was the first with Ubuntu following behind which caused a lot of dismay in the GNU/Linux community, as it was seen as kowtowing to Microsoft's Security beck and call. However, if such moves had not been made we would not be able to be running GNU/Linux today, but the shims do pose a security risk.
All that will change on 24.06.2026 when Microsoft will issue a new Certificate and will 'blacklist' all Linux shims as it has also been proven that there are security risks with these shims, as they were a workaround. Basically, shims are a band aid in order for GNU/Linux to boot - a bit like a puncture repair kit - it will be fine for so long, but eventually you will need to replace the damaged inner tube with a new one.
This is all because one corporation wants to not only dominate the world market, it wants you to think like them too, and to make sure you do, it will gather information on what you are using your computer for, which is none of their business.
There are attempts being made with LibreBoot, but as to how ready that is, or ever will be is cause for another discussion.
If people are concerned about Secure Boot shutting them out, then perhaps it is time to upgrade to GNU/Linux hardware and leave Windows on its own devices to rot.
Clearly, LibreBoot is not for the faint-hearted (I include myself in this group!):
And for those interested on how LibreBoot deals with TPM2.0:
"Libreboot is a free, open-source boot firmware based on coreboot that replaces proprietary BIOS/UEFI on specific Intel/AMD x86 and ARM devices, with recent updates (late 2024/early 2025) significantly enhancing TPM 2.0 support.
-
GRUB Integration : Recent Libreboot releases have integrated upstream GRUB fixes that add robust TPM 2.0 key protector support, including NV index handling, PCR dumping, and key unsealing capabilities, although this feature is not yet enabled by default in all configurations.
-
Hardware Compatibility : On specific hardware like the HP EliteBook 820 G2 , the onboard SLB 9660 TPM chip supports TPM 1.2 natively but can be upgraded to TPM 2.0 via firmware flashing; however, this requires careful handling to avoid bricking the device, as the stock firmware is incompatible with the upgrade.
-
Measured Boot : Libreboot supports measured boot chains using coreboot for hardware initialization and GRUB or SeaBIOS as payloads, allowing for integrity verification of the boot process via TPM 2.0 PCRs, particularly for non-UEFI-aware systems.
-
Open Source TPM Development : While Libreboot itself does not manufacture TPM chips, the ecosystem benefits from broader open-source initiatives, such as Google’s work on an open-source TPM 2.0 implementation for Chromebooks using Cortex-M3 cores and open hardware.
AI-generated answer. Please verify critical facts."
And ...
" How to enable TPM 2.0 key protector in Libreboot?
Finished
To enable the TPM 2.0 key protector in Libreboot , you must configure the GRUB payload (included in recent Libreboot releases) to unseal a disk encryption key stored in the TPM. This process involves sealing the key externally using grub-protect or tpm2_tools and adding specific commands to your grub.cfg .
1. Prerequisites and Sealing the Key
Before booting, you must seal your LUKS key (or other disk key) to the TPM's Platform Configuration Registers (PCRs). This is typically done using the grub-protect utility from a running Linux system with TPM 2.0 tools installed.
You can seal the key to a file or directly to a TPM NV Index . The NV Index method is often preferred in Libreboot environments to avoid storing a sealed key file on the EFI partition.
Example: Sealing to an NV Index Use grub-protect to seal the key (e.g., luks.key ) to NV index 0x1000000 , binding it to specific PCRs (e.g., 0, 2, 4, 7 which measure the boot process):
grub-protect --protector=tpm2 \
--action=add \
--tpm2key \
--tpm2-bank=sha256 \
--tpm2-pcrs=0,2,4,7 \
--tpm2-keyfile=luks.key \
--tpm2-nvindex=0x1000000
Note: Ensure the TPM is enabled in your Libreboot/SeaBIOS configuration. Recent Libreboot releases (late 2024/early 2025) have fixed TPM initialization issues on some boards, but on others (like the T480), TPM may be disabled by default in SeaBIOS payloads to prevent boot hangs."
If in doubt, DON'T!
