Rufus warns that Rescuezilla v2.5.1 has a revoked UFEI bootloader

[git-pt-andy]

When trying to create a Rescuezilla bootable USB drive for Win 11 using the rescuezilla-2.5.1-64bit.noble.iso and RUFUS I get an error message from RUFUS that says "RUFUS has detected that the ISO you have selected contains a UEFI bootloader that has been revoked and that will produce a "Security Violation" screen, when Secure Boot is enabled on a fully up to date UEFI system".

If I click past this message the USB is not created, it just hangs. I have also tried using BaleEtcher, but that just stops working whether I point to a local file or the URL . Also my system has secure boot disabled.

In short I cannot seem to use the current Rescuezilla ISO.

Suggestions appreciated and Thank you for all your hard work in making Rescuezilla available.

Andy

[kutzki]

Same thing happening to me today. Any solutions?

[shasheene]

Thanks for raising this issue. This will require a new version of Rescuezilla to fix.

This article What the fuck is an SBAT and why does everyone suddenly care provides a detailed technical explanation of what appears to be the root cause here.

Rescuezilla is built upon the Ubuntu Linux distribution using the Linux kernel and signed bootloader packages it provides, there's been changes in how these are validated for UEFI Secure Boot known as SBAT.

By building a new release (certainly for the new Ubuntu 24.10 Oracular) it will pull in the bootloader packages with this new SBAT level and that should solve the issue.

That said, looking at the 'Ubuntu Changelog' link on the secure boot package [1], I can see an update for Ubuntu 23.10 (Mantic) but one not the older Ubuntu 24.04 (Noble) which is a long-term support release so should also be getting updates.

[1] https://packages.ubuntu.com/noble/shim-signed

[ariel-aram]

The same thing happened with me, but at least the ISO actually flashed on the USB for me.

[daisukedaisn]

I am having the same problem with Rescuezilla 2.5.1 released on 2024-09-08 with this name rescuezilla-2.5.1-64bit.noble.iso.(https://github.com/rescuezilla/rescuezilla/releases/download/2.5.1/rescuezilla-2.5.1-64bit.noble.iso). The problem only affects Windows systems or dual boot systems using secure boot. Windows is responsible for the issue. No surprise there. I am not able to turn off secure boot on my dual boot system. If I could, this version would work. But the Rescuezilla download page gives no warning of this boot loader issue. It seems earlier versions would also have the same issue. The issue comes not from Rescuezilla per se, but from the OS it uses, Ubuntu. Ubuntu has released a version (24.04) with the updated certificate. Ubuntu explains the problem here.

For Linux users, this is a cascade of an old installation bug which uses the Windows EFI partition instead of the EFI partition created for the Linux install during the installation process. It would be great to fix that problem sometime. It might mean Windows would not run on a dual boot system but Linux could and could later be patched with a new shim.

Does anyone know when Rescuezilla will release a version using the patched Ubuntu?

[shasheene]

I have tested my solution in my release candidate for Rescuezilla v2.6. The problem appears solved, certainly on the Ubuntu 24.10 (Oracular) with the new Secure Boot shim (after updating the base build environment).

There's still one blocking issue for the actual Rescuezilla v2.6 release (impacting the partclone-nbd utility used by the Image Explorer feature).

Until then, here's a preview of: (Google Drive), reuploaded/renamed from the artifacts section here https://github.com/rescuezilla/rescuezilla/actions/runs/12981489271

SHA256SUM:

e28e68a3df0738dc7709eeaa0d200f5bf57b67161192c55e59f1a4ccf275f6e6  rescuezilla-2.5.1-47-g78761f24b-64bit.oracular.iso

As soon as I figure out how to fix the issue with partclone-nbd in the ISO, I'll release the changes as Rescuezilla v2.6.

[daisukedaisn]

Thank you so much for the update. I will check daily for release 2.6 and test it on my system and report back to you.

On Sunday, January 26, 2025, Shasheen Ediriweera ***@***.***> wrote: I have tested my solution in my release candidate for Rescuezilla v2.6.

The problem appears solved, certainly on the Ubuntu 24.10 (Oracular) with the new Secure Boot shim (after updating the base build environment).

There's still one blocking issue for the actual Rescuezilla v2.6 release

(impacting the partclone-nbd utility used by the Image Explorer feature).

Until then, here's a preview of: (Google Drive), reuploaded/renamed from

the artifacts section here https://github.com/rescuezilla/rescuezilla/actions/runs/12981489271

SHA256SUM: e28e68a3df0738dc7709eeaa0d200f5bf57b67161192c55e59f1a4ccf275f6e6

rescuezilla-2.5.1-47-g78761f24b-64bit.oracular.iso

As soon as I figure out how to fix the issue with partclone-nbd in the

ISO, I'll release the changes as Rescuezilla v2.6.

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.<

https://ci3.googleusercontent.com/meips/ADKq_Na0HlRjMJxL7x-Hcqx0cy6k45bkANuicGmb_uyNS7yDnDyDL85vCXu49yfwjWfGZhQtPbB2B2YasEu4ZrYxpEA1yT4aXmQpUCEMy7jTvDdSoQCXrnXdE0gKJkIz6Z6MZzl6czDEp97sdpMeHZ17xSkOMOGh_glafSGQDhZYckH584kZuqUfAom45m7XUFNwDn_JtavnnUUiRCzR7D5YEoqPHfu4v5u767WLyF4-_NRdB3q3F-xBT6w=s0-d-e1-ft#https://github.com/notifications/beacon/AYZYX7SI2WCUSFSM2B4RNOT2MW4NFA5CNFSM6AAAAABQV7WR2KWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTU33N3WW.gif>Message ID: ***@***.***>

[shasheene]

The user in #546 said rescuezilla-2.5.1-47-g78761f24b-64bit.oracular.iso didn't work for him (through Rufus at least)

[AlexBelz]

Hi,

same issue seen today on my side, with rescuezilla-2.5.1-64bit.noble.iso with Rufus in ISO Mode (not DD).

Is there any plan ?
Warmest regards.

[Kello-hub]

Hello.

I have the same issue using Rufus 4.6.2208 and Rescuezilla 2.5.1, but found a workaround:
Writing as ISO image fails, but writing as DD image works!

Kind regards

[Dzomlija]

I am getting this same error when writing "rescuezilla-2.5.1-64bit.noble.iso" to USB using Rufus 4.6.2208:

EDIT:
Despite the warning, the USB created with "rescuezilla-2.5.1-64bit.noble.iso" works fine, and booted without any problems or security warnings.

[daisukedaisn]

Hello Shasheen, I downloaded the Rescuezilla ISO from google docs using the link you provided. I verified the SHA256 checksum. I used Linux Mint's ImageWriter App to load it on a 128 GB SanDisk USB 3.2 Gen 1 Flash Drive. *The security certificate issue did not arise since the Penguin splash screen came up. So this is real progress!* I waited for several minutes while a series of about 5 horizontal dots in the middle of the screen scrolled by. But nothing else happened. I do have a lot of memory in my system but I am not backing up every drive! I was not sure how long to wait, but I did not recall this issue in the past. So I was not able to test the backup function. I forced a reboot and tried a second time but again it never got past the flash screen. Thank you, Daisuke

…

On Sun, Jan 26, 2025 at 9:00 PM Shasheen Ediriweera < ***@***.***> wrote: I have tested my solution in my release candidate for Rescuezilla v2.6. The problem appears solved, certainly on the Ubuntu 24.10 (Oracular) with the new Secure Boot shim (after updating the base build environment). There's still one blocking issue for the actual Rescuezilla v2.6 release (impacting the partclone-nbd utility used by the Image Explorer feature). Until then, here's a preview of: (Google Drive <https://drive.usercontent.google.com/download?id=1kPd33gPEwYYf3p_amArDhwFgDBygNXyI&export=download>), reuploaded/renamed from the artifacts section here https://github.com/rescuezilla/rescuezilla/actions/runs/12981489271 SHA256SUM: e28e68a3df0738dc7709eeaa0d200f5bf57b67161192c55e59f1a4ccf275f6e6 rescuezilla-2.5.1-47-g78761f24b-64bit.oracular.iso As soon as I figure out how to fix the issue with partclone-nbd in the ISO, I'll release the changes as Rescuezilla v2.6. — Reply to this email directly, view it on GitHub <#525 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AYZYX7T2LSST7X625HBYJQ32MW4NFAVCNFSM6AAAAABQV7WR2KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMJUHA2TCNBTGU> . You are receiving this because you commented.Message ID: ***@***.***>