Hello,
I have recently installed CachyOS with Limine and have just spent a couple of hours trying to get Secure Boot working. I followed the Secure Boot Setup page on the wiki and ran into an issue where I encountered the following error after re-enabling Secure Boot:
Secure Boot Violation
Invalid signature detected. Check Secure Boot Policy in Setup
OK
The only EFI binaries that need to be signed are Limine itself.
In my experience at least, the above statement is false. After re-reading and repeating the steps in the wiki numerous times, I eventually found a post in the forum that mentions BOOTX64.EFI needing to be signed as well and remembered that it had an x beside it when I did sudo sbctl verify.
I ran sudo sbctl sign -s /boot/EFI/BOOT/BOOTX64.EFI
Reenabled Secure Boot in UEFI
And I was able to boot into CachyOS with Secure Boot enabled.
Signing BOOTX64.EFI should either be a part of sudo limine-enroll-config or a step should to be added to the wiki.
There are a couple of points where I thought the instructions were unclear or insufficient. (Might be a bit nitpicky.)
Check the status of sbctl again to make sure that the keys are enrolled and setup mode is disabled”
For my motherboard at least, running sudo sbctl status immediately after running sudo sbctl enroll-keys --microsoft --firmware-builtin showed Setup Mode as Enabled. A reboot was needed for Setup Mode to become disabled in my case.
When I didn’t get the expected output, I was pretty lost. I eventually read that sometimes it takes a reboot for setup mode to be disabled and that was the case for my motherboard.
This is how the BIOS looks like on a Lenovo Ideapad 5 Pro. Reset to setup mode or restore factory keys and reboot back to the system.
I kind of doubt “Restore Factory Keys” is a valid choice here… Are you sure restoring factory keys enables Setup Mode?
To enable automatic config checksum enrollment, set the following in /etc/default/limine:
This threw me off for a bit because I thought /etc/default/limine was a directory. Maybe change to:
To enable automatic config checksum enrollment, open /etc/default/limine in a text editor and add the following line
Run the following command, replacing the path with the one you found in the previous step:
It was unclear what “the path” refers to. In the previous step, we found “boot():/limine-splash.png”
Which isn’t really a path we can use b2sum with. Luckily, copying the example worked.
Root permissions are required to perform the following steps, make sure to use sudo or switch to the root user before proceeding.
I’m not sure if this box is necessary? Doesn’t this apply to pretty much every command where you instruct the user to use sudo?
Generate a BLAKE2B hash for the splash image and append it to the path in the config file
-
It wasn’t clear to me what “config file” referred to here (and in step #3). I thought it referred to /etc/default/limine at first.
-
The “and append it to the path in the config file” portion is covered in the next step (#3) and should be omitted in this step (#2).
Secure Boot Status Check
Instruction for enabling Secure Boot in UEFI needs to be added before proceeding to the check step.
Thank you for your attention.