Linux-Docs/ArchSetup.md

Links: Arch

Secure Boot

If setting up secure boot with EndeavourOS, don't use the preset grub. do it from scratch. The wiki is wrong and your ${GRUB_MODULES} needs to be in ""

Steps

1. Install grub following the shim-lock info
   • If you do not have any drives with a ZFS filesystem, you should exclude the zfs* modules (As they require the ZFS DKMS Module)
2. Move grubx64.efi into the esp/EFI/BOOT directory and ensure is has that name.
3. Follow the steps to setup shim (shim with key), including the mkinicpio hook to automatically sign the kernel on update.
   • If you are using EndeavourOS, you will need to install mkinitcpio and uninstall dracut and eos-dracut
4. Generate the GRUB config file
   • If you are wanting to dual boot, install os-prober and uncomment GRUB_DISABLE_OS_PROBER=false in /etc/default/grub then regenerate the config
5. Enable Secure Boot and import your MOK.cer into shim's MOK list.

Note: If you ever re-install the GRUB grubx64.efi file (to get a newer version of GRUB for example), make sure to do so with the modules as described above, and you will need to re-sign the file with sbsign.