Setting up Secure Boot in Arch-based Distributions

Tutorials & Resources
21

I remember my 60s. They were good times, but then, so are my 70s :slight_smile:

You’re welcome. I’m glad you liked my work. Interestingly, as it turns out, EndeavourOS is one of the more complex Arch-based distributions for setting up Secure Boot compatibility because I had to sign three images to get it to boot successfully using both the primary and the fall-back boot options in rENInd. After I wrote this item, I installed and set up Manjaro Linux in a VM and I only had to sign the vmlinuz image (in the /boot directory), so its more straight-forward when setting up compatibility for Secure Boot.

Ernie

1 Like
22

Right again, Dan, thanks for the correction. BTW, I put some effort in with Fedora 39 and walked my way (with guidance) through using dnf to install my printers .rpm package and was successful. Old dog, one or two new tricks.

1 Like
23

I actually tried Fedora 36 and 37 for a while… But they make some things harder than they need to be - e.g. GPU drivers - you have to setup RPMFusion - which was a PITA - Ubuntu and Pop!_OS do that stuff 10x more easily…

IF I boot up the live Pop!_OS image, it’s already supporting my AMD Radeon GPU with recent accelerated open source drivers…

So - I think I’m sticking with Pop! for the foresee-able future… :smiley: Both Pop and Ubuntu automagically find my Brother printer on the network, know that I’m in Australia and default my page to A4…

1 Like
24

It’s always a very good thing when your OS knows where in the world you are and what hardware is attached to your computer, etc. :slight_smile:

1 Like
25

Currently running Arch. If I want to enable Secure Boot, ReBar and Above 4G memory do I also have to convert the file system from ext4 to GPT in addition to running your insctructions above? I know Windows requires GPT to use those features. have Arch on a 2Tb nvme drive.

26

GPT refers to the partition table style being used on your disk drive. The partition table is the mechanism used by disk drives to keep track of where files and directories are located. PCs use one of two common types of firmware to manage disk drives. The earlier/original style was called BIOS (Basic Input Output System), and it used the MBR (Master Boot Record aka MS-DOS) partition table. The newer/current style is called UEFI (Unified Extensible Firmware Interface), and it uses the GPT (Guid Partition Table) partition table.

EXT4 refers to the type of file system you’re using on the disk drive, and is compatible with either style of partition table (mentioned above). In order to answer your question, I’ll need more information:

Does your computer support Secure Boot (Does it use UEFI firmware)? If your computer has, or came with Windows 11 installed, it uses UEFI firmware, and your partition table is GPT. If your computer has, or came with Windows 10 (and was built after about 2008), the answer is less certain. Read this item for more information.

If your computer uses MBR partition tables, and you want to switch to GPT, you can make the change, but everything on the disk drive will be unrecoverably erased, so you should back up all your data before changing the partition table style.

I hope this helps. If you have more questions, reply to this thread,

Ernie

2 Likes
27

My computer does support Secure Boot but it is not enabled, BIOS is set to Legacy. I have 2 nvme drives one with Win 10, the other Arch. Want to install an Intel ARC A770 16Gb video card, which requires ReBar & Above 4G Memory Enable to be set in the BIOS. But to enable those Secure Boot needs to be turned on. I know Windows 10 & 11 require the drive to be GPT. What I don’t know is whether I would need to convert the Arch drive from MBR to GPT.

I have a tutorial to convert from MBR to GPT on Linux w/o data loss and have performed the MBR to GPT conversion on a few Win 10 drives to upgrade to Win 11 preserving the data just fine.

2 Likes
28

Yes, you’ll need to do that.

I’ve not heard of that process, but if you’ve completed the task before, all I can say is to go on ahead and do it, but I strongly suggest you back up your data, just to be safe. After you change the drive to GPT, disable Secure Boot so you can boot into Arch, and complete my instructions to make it able to boot with Secure Boot enabled. Note that you probably won’t be able to install rEFInd until after you convert the partition table to GPT (I’ve never tried installing rEFInd on an MBR partitioned disk). After you get rEFInd and your kernel images signed, you can re-enable Secure Boot. If all goes well, after you enroll rEFInd’s key in MOK, Arch should boot O.K.

If your tutorial’s online, please post the link here, so others can benefit from it.

I hope this helps,

Ernie

2 Likes