"Revoked UEFI bootloader" warning when trying to create a bootable Fedora 42 KDE USB with Rufus

[trowel759 (Vlad Moglan)]

I’m sure it’s nothing, but this is just a little sus

[pg-tips (P G)]

I think Rufus is giving this warning because the Secure Boot shim on the F42 ISOs is signed with the “old” Microsoft signing key (albeit the key is valid until June 2026).

I can’t find this absolutely explicitly stated by Rufus - I’m inferring it from the response to this GitHub issue, and this FAQ item.

I’m not sure whether the F43 ISOs are signed with the same key. From the first linked thread, any shim signed after Sep 2025 will use the new key, but not sure if we have a new shim for F43.

[trowel759 (Vlad Moglan)]

Yeah sounds plausible, just wanted to make sure I didn’t accidentally download some malware or the Fedora mirror is compromised. I did downloaded it multiple times to make sure and… yeah, it’s the same error every time

[theprogram (MatH)]

Follow the steps at Fedora keeps you safe | The Fedora Project to make sure

[jrredho (john r red-horse)]

Wasn’t there a peculiarity in the bootloader distributed with the f42 Workstation ISO? I seem to remember that it was adding UEFI bootloader targets without indicating it was doing that to users. Is it possible that this is what is triggering the message?

[pg-tips (P G)]

@jrredho

Wasn’t there a peculiarity in the bootloader distributed with the f42 Workstation ISO?

Yes:

Merely booting Fedora 42 Live media adds a "Fedora" entry to the UEFI boot menu

Problem As the Fedora Linux 42 release was halfway out the door, we became aware of an issue with many of the Live images in the release. This issue also affects two of the Fedora 41 live images. Affected images will add an unexpected entry to the UEFI boot manager list as soon as the medium is booted, even if you do not go on to install Fedora. The new entry is added to the top of the list (so it’s the first priority on boot). The entry is titled “Fedora”, and attempts to boot the Fedora live …

I don’t think this is related, because Rufus seems to fire this warning even on Windows bootloaders signed with the older key, A good test though would be to try it with a Fedora 41 ISO (which would use the older key but doesn’t have the “self-repair” “feature” that causes that issue in F42).

[vekruse (Villy Kruse)]

@pg-tips

I think Rufus is giving this warning because the Secure Boot shim on the F42 ISOs is signed with the “old” Microsoft signing key (albeit the key is valid until June 2026).

There are currently no Fedora shims signed by the new MS signing key. In fact, the shim provided by Fedora 42 is the same as is the one provided by Fedora 43. It is not even re-compiled because if the shim is re-compiled it needs to be sent to Microsoft to be signed.