Following an update in Garuda Linux, I became unable to log into Windows from the grub boot loader. The first time it happened, Windows apparently tried to load, but all I ended up with was a blank screen that I couldn’t CTRL+ALT+DELETE out of; the only thing that got me free of that screen was to force a shutdown, then I could choose Garuda from grub. Next I tried restarting to the system boot menu from which Windows loaded as expected, so I knew the issue was with grub, but no one on the Garuda forum offered a fix when I asked, so next, I tried installing rEFInd. For whatever reason, that apparently corrupted my esp, resulting in me being unable to access either Windows or Garuda.
Over the next few days I tried as many combinations of installing Windows and Garuda, all of which failed. Since I first learned about sbctl, a utility to enable secure boot (needed foe Windows) from an article about it that referenced the Cachy Wiki, I decided to research that distribution. While it’s quite different from Garuda (I miss the Garuda toolbox in particular), because both distributions are Arch-based, they’re more alike than different. One difference s that Cachy comes equipped to allow me to choose from a variety of boot loaders, with the one recommended by Google’s Gemini being Limine for use with secure boot.
I decided to give CachyOS a try, and the installation went flawlessly, so today, I’m successfully dual-booting CachyOS with Windows 11 Pro 25H2, and unless Garuda comes up with a fix for grub fairly soon, or adds support for additional boot loaders as CachyOS does, I may not be looking back any time soon. I’ve been able to get Cachy configured like my Garuda desktop’s look-n-feel, so I’m feeling right at home after less than a day!
I find it difficult to imagine how a Garuda update could damage the grub entry for another distro.?
Is your windows grub a 40-custom configuration? If so, perhaps the 40-custom file got lost if the garuda update did an update-grub. ?
The other thought I had is that maybe Calamares did not configure things well when you originally installed Garuda.,
I have had some interaction with the Calamares people, and the impression I came away with was that the Calamares team do not fully understand how multiboot grub works.
Anyway , you found a workaround with CachyOS … another good Arch based distro is Artix.
During my research to understand what happened, I saw an item stating that grub can have an issue with dual-boot while secure boot is enabled. I knew that the issue was with Grub, because I could boot to Windows via the system boot menu (F12 on my computer), and grub would boot Garuda OK. It wasn’t until I decided to try installing rEFInd that my computer wouldn’t boot anything and I decided to wipe the drive and start over.
I have a bit of a learning curve ahead of me, considering how security conscious Limine is when secure boot’s enabled, and how different the system maintenance tools are from what I was accustomed to on Garuda, but all in all, I’m looking forward to the learning!
Garuda uses btrfs filesystem.
I would not recommend btrfs or zfs filesystems if you multiboot.
The problem is they write some bytes of info on the system area of the disk before the first filesystem , and it can interfere with the operation of grub.
What filesystem did you choose for Cachyos ? I think it would be safest to stick with ext4.
Secure boot may also write on the disk system area?
I am not sure if Windows does?
I checked with AI
" Yes, Btrfs writes to a specialized “System” area on the disk, but it does not work like a fixed or legacy system partition"
but
“No, Secure Boot does not write anything into the system area of your disk”
and
" Yes, Windows writes to the raw system and boot areas of a disk outside of the normal file system during setup, booting, and maintenance."
So , I think interfering with the disk system area is the most likely explanation.
If you are using btrfs with CachyOS I would recommend you wipe the disk again and install CachyOS with ext4 filesystem.
Both Limine and grub do not themselves write to the system area of the disk if used in uefi mode, but they do if used in legacy mode.
I stuck with Cachy’s default … btrfs, but the Limine boot loader works well with secure boot. The install went flawlessly, and I’ve already learned how to change the default graphical background. I’m impressed with how security conscious Limine’s dev-team has been. It requires that I provide a hash for the image file I use that’s calculated with a specific utility, and that I include it following the file path, separated with a hash character - fitting, actually . Then I update Limine with an update utility included with the loader. I learned about all that the hard way, but I was able to boot a live Cachy session and fix my mistake with the help of Google’s AI from Firefox’s address bar. When I get a few minutes, I’m going to ask Gemini for the correct steps to change Limine’s background so I have it if I decide to make a change in the future.
like I said in my OP, Cachy feels like home due to its similarities with Garuda while at the same time presenting a brave new world for me to explore!
I know, but you cannot deny that it’s significantly more secure with it enabled, and since CachyOS implements the feature using Microsoft’s keys, and correctly implements support during the process of implementing support, it also gains by closing yet another attack surface. And since the Limine boot loader requires file hashing when secure boot’s enabled, it too gains in security.
To tell the truth, I’m very impressed with the advances CachyOS has made since I last gave it a try. Now, if Garuda would team up with Cachy, both distributions could learn from each other, and raise the security and ease of use bars for GNU/Linux in general, together
I’m unsure what you mean by “unofficial” images, but the real job of secure boot is to prevent malware from being installed in locations (such as the EFI) that your running OS cannot see or scan. The EFI is where your OSes bootloader(s) is(are) installed, and enabling secure boot prevents any unsigned process from executing. So your boot loader, your system kernel, and drivers such as your video, WiFi, etc. drivers must be signed. In other words, anything that executes with the same level of privileges as the system kernel, or the boot loader (which starts the system kernel) must be signed with one half of a key pair, the other half of which is stored in the TPM (an encrypted storage space within either your computer’s CPU or on a discrete device (TPM chip) installed on your computer’s motherboard), and secure boot compares the signature on every system-level process that attempts to run with system-level privileges before allowing it to load into memory. For example, if your boot loader is unsigned, and you enable secure boot, your computer will refuse to allow the boot loader to execute, and your computer will display an error message, and refuse to load your OS.
I dont see that requiring signatures protects anything.
What is to stop some malicious person from having a signed but modified version of software , and installing or booting it on your computer with physical access.?
i thought secure boot was supposed to prevent booting any old usb drive?
Edit… OK you partly answered it in that other topic .
There is a private key.
Yes. It’s essentially a key pair, a public key to crypto-graphically sign the kernel, the boot loader, and any system level drivers, and a private key that the system compares the public keys with to determine trustworthiness.
Your Linux/W11 setup is a disaster waiting to happen!! Why do think that secure boot should not be disabled? You lock W11 down with secure boot and TPM and you think Windows will not react!! I am thinking you are in need of two machines, one for Linux and one for Windows!! Good luck!!
The stuff that loads before the OS is what it protects. It protects it by only allowing official versions to be loaded. If it doesn’t have proper signing, it isn’t official.
Why so adamant? How I set up my computer should be my choice. If you dislike Windows so much then don’t read my posts that involve the OS, but please, give me the right to make my own choices. After all, isn’t freedom what GNU/Linux is all about?
Of course, you are free to choose whatever configuration you prefer.
but
I am afraid I feel like @4dandl4 … your setup is risky. But you are clever enough to manage it.
Dont misunderstand Daniel … he puts things too strongly at times, but he means well.
Then I’d suggest it’s something he may want to consider working on. As you indicate, I’m capable of managing the risks of how I have my computer configured. Additionally, I only post about my ‘adventures’ when I learn something that I think may be useful to others. I’m certain that I’m not the only user who dual-boots GNU/Linux with Windows, and I’m certain that I’m not the only one who wants to be able to increase Windows security with secure boot while dual-booting it with GNU/Linux. I promise that I won’t be offended by those who have no interest in Windows or secure boot not reading such posts by me
. Then I update Limine with an update utility included with the loader. I learned about all that the hard way, but I was able to boot a live Cachy session and fix my mistake with the help of Google’s AI from Firefox’s address bar. When I get a few minutes, I’m going to ask Gemini for the correct steps to change Limine’s background so I have it if I decide to make a change in the future.