Dell Precision 7560 -- OptionROM in the bootchain -- possible workarounds

[jibanes]

I'm running into the "OptionROM" issue (Found OptionRom in the bootchain. This means we should not enroll keys into UEFI without some precautions) on a Dell Precision 7560, I understand I have two options: either force to enroll-keys without the microsoft OEM certificates into the signatures database and try risking to brick the laptop or keep the microsoft OEM certificates into the signature database.

In the first case, how can I figure out if the Bios uses integrated graphics or discrete graphics, so in the event that I have forced to enroll-keys without the microsoft OEM certificates I would be able to simply reboot and disable secure boot? If that's not possible, what are my chances of success if I enroll optionrom checksums into the signature database?

In the second case, which is keeping the microsoft OEM certificates into the signature database, I understand this means that any OS (windows 11, or a Ubuntu shim signed by microsoft) will be able to run on this machine; and, subsequently, if I extract the signed shim loader from a ubuntu installation cdrom I could simply boot any (linux) operating system I want (please correct my assumptions if necessary.)

Finally, is there another option I have not considered?

[Foxboron]

In the first case, how can I figure out if the Bios uses integrated graphics or discrete graphics, so in the event that I have forced to enroll-keys without the microsoft OEM certificates I would be able to simply reboot and disable secure boot?

I don't know.

If that's not possible, what are my chances of success if I enroll optionrom checksums into the signature database?

After implementing --tpm-eventlog I have not heard about this failing. But I don't know how widely used this method is.

In the second case, which is keeping the microsoft OEM certificates into the signature database, I understand this means that any OS (windows 11, or a Ubuntu shim signed by microsoft) will be able to run on this machine; and, subsequently, if I extract the signed shim loader from a ubuntu installation cdrom I could simply boot any (linux) operating system I want (please correct my assumptions if necessary.)

This only works if you have installs signed with the embedded key inside the shim binary. In practise you just enroll a MOK, but at that point you don't need to deal with sbctl as we do not support MOK yet.

Finally, is there another option I have not considered?

You can enroll the OEM provided certificates through --firmware-builtin

[jibanes]

You can enroll the OEM provided certificates through --firmware-builtin

What is the success rate of this method? Do you think I should try, this model doesn't have a bios recovery option afaik.

[Foxboron]

What is the success rate of this method? Do you think I should try, this model doesn't have a bios recovery option afaik.

I don't know. I don't collect statistics and don't intend to either.

[jibanes]

I physically removed the GPU from the laptop, now I don't see an OptROM, problem solved.