Component

bootctl

Is your feature request related to a problem? Please describe

Systemd-boot right now installs itself (bootctl install) like this in the
ESP (star marks boot entry):

\EFI\BOOT\BOOTX64.EFI    <-- systemd-boot
\EFI\systemd\systemd-bootx64.efi  *

To make systemd-boot usable on real hardware with secure boot enabled, it would have to be signed by the MS 3rd party CA. That's probably not going to happen so the way to do that would be make sd-boot bootable by shim.

Describe the solution you'd like

Assuming systemd-boot is signed with a vendor certificate, the
way to install both shim and systemd-boot would be what is outlined
in https://github.com/rhboot/shim/blob/main/README.fallback

for removable media:

\EFI\BOOT\BOOTX64.EFI    <-- shim
\EFI\BOOT\MokManager.efi
\EFI\BOOT\grubx64.efi    <-- systemd-boot

for an installed system:

\EFI\BOOT\BOOTX64.EFI    <-- shim
\EFI\BOOT\MokManager.efi
\EFI\BOOT\fallback.efi
\EFI\vendor\BOOT.CSV
\EFI\vendor\shim.efi     *
\EFI\vendor\MokManager.efi
\EFI\vendor\grubx64.efi  <-- systemd-boot

(Yeah, for now systemd-boot would have to name itself after grub as
that's hardcoded in shim).

So my question is would you accept patches to bootctl that (eg via
build time option) installs systemd-boot as outlined above if shim
is installed?

If so, a way would be to eg have the shim package symlink it's files
into /usr/lib/systemd/boot/efi/. Bootctl already installs *.efi from
there. We'd need a hack to the systemd-boot -> grub renaming though.

The other alternative would be to either not use bootctl install
at all, or have some script mangle what it did to retrofit shim.

Thoughts? :-)

Describe alternatives you've considered

No response

The systemd version you checked that didn't have the feature you are asking for

No response