Sudden Secure Boot Update from Windows on Debian?

*Version 20260402:

*Version 20250902:

This updates the 3rd Party UEFI Signature Database (the "db") to the latest release from Microsoft.It also adds the latest OptionROM UEFI Signature Database update.

Essentialy Microsoft has a monopoly around secure boot. They also sign the Linux bootloaders. While you can technically do an independent setup it’s a rather involved process.

To finally answer your question, no they don’t destroy our uefi and yes Linux needs them. There is less harm in doing the update then not.

If you don’t need secure boot i would advice you to disable it as in its default configuration it isn’t securing you form anything.

They're just updates for your motherboard's secure boot database. Basically every PC on earth uses Microsoft's Certificate Authority, so updates like this are provided via ``fwupd``. It's recommended to update these if you're using secure boot, and it won't do anything to your UEFI settings.

Firmware updates are provided through fwupdmgr. Most computers use Microsoft's certificate for Secure Boot. Even if you don't have Windows installed, you will get updates for the Microsoft certificates and blacklist.

If you have Secure Boot enabled, then you will need to update the 3rd Party Signature Database, as Debian and most other distros that support Secure Boot are signed by Microsoft and the older certificate expired in June. New shim updates will only be work with the new certificate.

I'll try to explain a simple as possible: The shim for the Linux bootloader is signed by Microsofts key. This signature is checked, when "Secure boot' is activated on your Computer.
Since the old keys now runned out of validity, the next update of the shim will no longer carry the signature by the old key, but the new key. Hence the certificates in the motherboards memory needs to be updated. Otherwise, an activates "secure boot" would not be able to validate the integrity of the shim and very probably "brutally halt with a red screen" at boot time.

Your Linux installation will be fine, no Windows involved, and you may accept the updates, which will be okay. If you use "secure boot", it will save you from future troubles. If you do NOT use it, the update has no real effect.

I suggest to accept the updates, and then forget about it.

Then we should move to Mars asap.

The secure boot DBX and DB updates will be through fwupd, not apt. The update will be for the 2023 certificate as the 2011 certificate has expired and can't be used for new signings.

You're getting it because while you don't have windows, the Microsoft secure boot key is still used to authenticate booting of Linux via shim

And even then you might wanna have up to date keys and especially revocations, especially if you haven't explicitly thrown out everything that isn't your mok

Others have explained the details very well, but I'll give a broader view.

In a cryptographic (encryption OR validation) ecosystem someone (or some people) have to own the "root" of the system.

For https there are quite a few, and if you look you can find which ones your computer trusts. Pretty much everyone has the same list because there's a general agreement about which companies can be trusted with that responsibility. Any breaches and browsers/os's revoke them.

Those companies act as "trustees" of a sort. You might not like GoDaddy, their slight scammy feeling if you use them for hosting etc, but "you" do trust them to keep their root keys secure and not go issuing random certificates.

With secure boot on PCs the industry has chosen Microsoft as a safe custodian of the root keys. While this is the same company that pushed IE illegally, won't release office on Linux, used to be extremely anti open source, etc they act differently in this role.

They take it seriously, and have not shown any reason not to trust them FOR THIS. They sign Linux bootloaders, have never done anything dodgy, etc.

Secure boot is/can be a good thing. Ignoring how windows might use it in the future, it enables Linux users to trust the integrity of their boot loader. Most/all immutable linuxes require or recommend turning it on, for example.

Why not just turn off Secure Boot?

It is update of Secure Boot keys for UEFI BIOS. Unless you use Coreboot (and you probably don't, as it supported by very few systems and installed by default by even fewer: System76, StarLabs, etc.), it is advisable for you to install it.