sbctl with thinkpads

[Heresy6]

Heya,

I try to search my way in all forums but never found a clear answear so i post it here :

I plan to buy one of the latest T14 gen 5 ( amd ) And i see that thinkpads products are known to be " sensitive " to secure boot cuz of vendor Rom Keys.

So i plan to use the # sbctl enroll-keys -m but the archwiki advertise to a risk even using that.
So did i need to use # sbctl enroll-keys -m -f to be sure ?

Also, did anyone try this on the latest generation ( 3 and 4 ) with sucess ? I was using sbctl for my framework pc with great sucess, but i'm not that confortable with the risk of loosing money.

Thx in advance for your advised answers :)

[Foxboron]

I plan to buy one of the latest T14 gen 5 ( amd ) And i see that thinkpads products are known to be " sensitive " to secure boot cuz of vendor Rom Keys.

This is platform and architecture dependent. sbctl was developed on an Intel T14 Gen 1 but that has no bearing on modern devices. Claiming a vendor is more "sensitive" to stuff because of possible OpROM misses the point and isn't a useful generalization.

So i plan to use the # sbctl enroll-keys -m but the archwiki advertise to a risk even using that. So did i need to use # sbctl enroll-keys -m -f to be sure ?

I don't know. If you want to enroll with default keys use -f and if you only want Microsoft OEM keys use -m. Combining them isn't useful as all these devices are provisioned with Microsoft keys.

Also, did anyone try this on the latest generation ( 3 and 4 ) with sucess ?

I don't know.

I was using sbctl for my framework pc with great sucess, but i'm not that confortable with the risk of loosing money.

You won't "brick" your early boot environment with integrated graphics. The issue is PCIe devices, like NVMe disks, and dedicated GFX cards and so on.

[Heresy6]

I want to thank you for your very quick answer :)

So if i understand you correctly, i'm safe if i enroll microsoft keys ?

[Foxboron]

So if i understand you correctly, i'm safe if i enroll microsoft keys ?

To quote the license.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.

I don't know firmware and there is no way for me to give you a definitive answer. It will most likely be fine.

[Heresy6]

Thank you, it's exactly the answer i wanted :)