Dual boot with Win11.
I just installed CachyOS yesterday. So far so good, I’m loving it of course!
I had used Ubuntu, Mint, and Pop! OS before. First time with an Arch-base distro.
I have been following the Wiki tutorial. This is what I’ve done so far:
Installed sbctl
I skipped the Grub pre-setup as I chose Lamine instead.
I went to the BIOS by using the given command line: systemctl reboot --firmware-setup
It worked. Once there I enabled Secure Boot, and restored factory keys. I saved the changes and rebooted. Unfortunately as soon as the pc started booting it showed me a warning saying:
“Secure Boot Violation, invalid signature detected. Check Secure Boot policy in Setup.”.
It seems like what the wiki calls “setup mode” in fact has secure boot disabled, at least it definitely should not be verifying signatures at that step. So try turning it off and proceed with the guide.
The guide definitely works as I’m also using Secure Boot and Limine and followed the guide. In the guide it also shows how to check whether Secure Boot is in Setup Mode or Disabled, they’re not the same thing so when it says you need to be in Setup Mode you need to be in Setup Mode. I think when Secure Boot is disabled it doesn’t let keys get added to Secure Boot because it’s off, when it’s in Setup Mode I think it’s expecting to have keys added to it.
On my motherboard I had to choose “Reset to Setup Mode” which was the option underneath “Restore Factory Keys” in my BIOS.
Thank you Riley.
I also have Reset to Setup Mode below Restore Factory Keys. I just did it. But I’m still getting this: sbctl status
Installed: ✗ sbctl is not installed
Setup Mode: ✓ Disabled
Secure Boot: ✗ Disabled
Vendor Keys: microsoft builtin-PK
I find this Secure Boot process so bloody confusing.
What should I do next then?
Is your BIOS giving you a choice after you choose “Reset to Setup Mode?” Mine gave a cryptic message asking if I wanted to continue without saving which made it look like it wasn’t going to work but I said Yes and let it do its’ thing and it got me in Setup Mode. Different BIOSes may word it different so if it gives you a choice maybe try the other choice? It really felt like the wording of that popup was poorly translated into my language of English so maybe it gives a misleading popup on yours too?
Until you find out how to get the BIOS into setup mode the rest of the guide is irrelevant so we have to get past that but the “good news” is that it also has nothing to do linux so the only place to look is in the BIOS.
Maybe you could take screenshots of the BIOS choices with a camera and upload them?
I am a bit of an idiot though, I didn’t see you were dual booting with Windows 11, since I don’t dual boot I don’t know if the guide is still working in that regard so maybe it still won’t play nice after you find out how to get into Setup Mode and enroll your keys.
Ok so I did Reset to Setup.
Then I tried to enable Secure Boot, as the screenshot of the IdeaPad shows in the tutorial. But that’s when I was told that the system is in Setup mode!
After this I thought I had it the way it should be. However when I check the sbctl status it says the Setup Mode is disabled.
What do you think I’m missing?
You’re definitely in the correct spot to enable Setup Mode. On my board I had to click Reset to Setup Mode, I chose yes to the next option it gave me, the system rebooted and I went into CachyOS and then followed the guide.
After choosing Reset to Setup Mode you’re not immediately changing another Secure Boot option in the BIOS are you? You should only choose Reset to Setup Mode and save and exit and boot into CachyOS to finish the guide.
Out of curiosity what’s the motherboard model? Maybe we could look up the vendor and see if there was a bios issue or some other oddity that people ran into.
I guess I must have done too much by disabling the “Factory Key Provision“, this is what I’ve got when I issued this command: “sudo sbctl enroll-keys“:
“Could not find any TPM Eventlog in the system. This means we do not know if there is any OptionROM present on the system.
There are three flags that can be used:–microsoft: Enroll the Microsoft OEM certificates into the signature database.–tpm-eventlog: Enroll OpRom checksums into the signature database (experimental!).–yes-this-might-brick-my-machine: Ignore this warning and continue regardless.
This is good, you’re making progress! I actually made the same mistake, the command is not “sudo sbctl enroll-keys“ but “sudo sbctl enroll-keys --microsoft,” on the guide the flag “–microsoft” is a different color so it looks like you’re not supposed to include but you actually are. So the whole command is:
sudo sbctl enroll-keys --microsoft
Basically we’re using a Microsoft issued key to sign your bootloader and kernel on linux. You can read about how the previous Microsoft key, which coincidentally expires today, may effect people here: Linux and Secure Boot certificate expiration [LWN.net]
Edit: Shouldn’t effect you since you’d be using a newly signed key but it’s good to have a little passing knowledge on it in case we run into something in the future where perhaps our keys expire.
My Setup Mode is disabled again. I’ll have to re-enable Factory Key Provision.
But due to what you kindly shared about MS re-issuing the key/s, I’ll wait until tomorrow.
Thank you so much Riley
See you soon
Hey Riley!
I did not know that I had the choice. Check what ChatGPT said:
”My suggestion:
If your main goal is to get Secure Boot back on, go back to Key Management → Restore Factory Keys.
If you want to go the custom route (using sbctl fully), I can walk you through wiping factory keys clean again and enrolling your own with Linux.
Do you want to (A) restore Microsoft’s factory keys (easiest, Secure Boot works with both Windows + signed Linux bootloaders) or (B) go all-in with sbctl and your own keys?”
Well, when you put it that way, and considering all the headache and hassle this has been so far, I’d just go with (A). What do you think? Would that work? Would there be too many cons?
There really shouldn’t be downsides to using your own keys, especially if you also enroll the stock Microsoft keys (you usually should). Actually, I’d expect using a secondary bootloader to be significantly more annoying in the long run, at least in part because it’s not the usual way of doing things on Cachy.
P.S.: please consider consulting the arch wiki on this subject instead of an LLM! It’s significantly more likely to be correct and covers the different methods as well.
Thank you eritheswitch.
I have read that most Linux distros are not yet activating SecureBoot as they are waiting for a Microsoft-signed shim with an embedded certificate. So given that and the hassle I’m going through…I have decided to put this Secure Boot issue to rest, for now. And monitor it. Maybe in a month or 2, if things become more stable and predictable I’ll retake it. Or I might just do without it.
No we aren’t. We’re enrolling the keys that we just created and the microsoft keys. The MS keys might be needed because they were used to sign option ROMS, windows if dual booting, etc. We can’t sign anything with them (and if we could they’d be worthless).
The alternative process of using an MS-signed shim is completely different and not what sbctl does.
The wiki is missing one last step, make sure under your UEFI’s boot menu the cachyos is the default boot option as UEFI OS is the one that fails to boot. After I switched them around, I got grub to boot into secure boot mode/option.
