Issue booting fcos 41.20250130.3.0 x86_64 on Dell machines using shim.efi over PXE

[robbycuenot]

Bug Report

I use shim.efi to PXE boot FCOS on bare metal with UEFI / Secure Boot on dell optiplex micro servers. My process for doing this is here: https://github.com/robbycuenot/uefi-pxe-agents

I've upgraded to the latest FCOS build and pulled the latest shim.efi and grubx64.efi files, but encountered the following error when trying to boot: rhboot/shim#649

Looks like a breaking change was introduced in shim between 15.6 and 15.8, but oddly enough this is specific to Dell hardware.

The latest shim release candidate has a change that should fix it: rhboot/shim#694

I can imagine that this project will wait for an official release of shim rather than an RC, but as soon as that is available I'd be happy to test a build with shim 16. Thanks :)

As a side note, is there a reason why shim.efi is not packaged directly within the iso? I believe this used to be the case, but was removed for some reason.

Environment

Machine: Dell Optiplex 7060 Micro
fedora-coreos-41.20250130.3.0-live.x86_64.iso

Expected Behavior

Machine boots with UEFI / Secure Boot over PXE

Actual Behavior

Boot fails around shim.efi stage, with a message similar to this:

RRQ from 192.168.16.97 filename loader/shimx64.efi.signed
tftp: client does not accept options
RRQ from 192.168.16.97 filename loader/shimx64.efi.signed
RRQ from 192.168.16.97 filename oader/revocations.efi
sending NAK (1, File not found) to 192.168.16.97
RRQ from 192.168.16.97 filename loader/?USB

Reproduction Steps

1. Follow this guide for repo steps, substituting the guide's iso for the FCOS 41 iso: https://github.com/robbycuenot/uefi-pxe-agents

[dustymabe]

The latest shim release candidate has a change that should fix it: rhboot/shim#694

I can imagine that this project will wait for an official release of shim rather than an RC, but as soon as that is available I'd be happy to test a build with shim 16. Thanks :)

You could open a bug aginst shim in Fedora and request a backport. The maintainers will evaluate the risk and decide whether it's OK or not. Alternatively you could open a PR (which means the maintainers would have to do less work if they decided to accept it).

[robbycuenot]

@dustymabe I left a comment on the Bugzilla page here, looks like someone already filed a report: https://bugzilla.redhat.com/show_bug.cgi?id=2304604

I'll investigate making a PR. Thanks!