Aiden Gerbrandt
ec1cc58137
Added ArchSetup Signed-off-by: Aiden Gerbrandt <aiden.gerbrandt@entropic.pro>
18 lines
1.4 KiB
Markdown
18 lines
1.4 KiB
Markdown
Links:
|
|
[Arch](Arch.md)
|
|
|
|
### Secure Boot
|
|
If setting up secure boot with EndeavourOS, don't use the preset grub. do it from scratch.
|
|
The wiki is wrong and your ${GRUB_MODULES} needs to be in ""
|
|
#### Steps
|
|
1. [Install grub following the shim-lock info ](https://wiki.archlinux.org/title/GRUB#Shim-lock)
|
|
- If you do not have any drives with a ZFS filesystem, you should exclude the zfs* modules (As they require the ZFS [DKMS](https://wiki.archlinux.org/title/DKMS) Module)
|
|
2. Move `grubx64.efi` into the `esp/EFI/BOOT` directory and ensure is has that name.
|
|
3. [Follow the steps to setup shim](https://wiki.archlinux.org/title/Secure_Boot#Set_up_shim) (shim with key), including the mkinicpio hook to automatically sign the kernel on update.
|
|
- If you are using EndeavourOS, you will need to install `mkinitcpio` and uninstall `dracut` and `eos-dracut`
|
|
4. [Generate the GRUB config file](https://wiki.archlinux.org/title/GRUB#Generate_the_main_configuration_file)
|
|
- If you are wanting to dual boot, install `os-prober` and uncomment `GRUB_DISABLE_OS_PROBER=false` in `/etc/default/grub` then regenerate the config
|
|
5. Enable Secure Boot and import your MOK.cer into shim's MOK list.
|
|
|
|
**Note:** If you ever re-install the GRUB `grubx64.efi` file (to get a newer version of GRUB for example), make sure to do so with the modules as described above, and you will need to re-sign the file with `sbsign`.
|