KunalGautam · September 1, 2026 08:58
diff --git a/README.md b/README.md
diff --git a/enable-secure-boot.sh b/enable-secure-boot.sh
 #!/usr/bin/env bash
 # ==============================================================================
 # Arch Linux Secure Boot Setup Script (systemd-boot + UKI + sbctl)
 # ==============================================================================
 set -euo pipefail

 # Ensure script is executed with root privileges
 if [ "$EUID" -ne 0 ]; then
    echo "This script requires root privileges. Elevating with sudo..."
    exec sudo "$0" "$@"
 fi

 echo "================================================================="
 echo "   Arch Linux Secure Boot Configuration (systemd-boot + UKI)     "
 echo "================================================================="
 echo ""

 # 1. Install sbctl
 if ! command -v sbctl &> /dev/null; then
    echo "==> [1/5] Installing sbctl..."
    pacman -S --needed --noconfirm sbctl
 else
    echo "==> [1/5] sbctl is already installed."
 fi

 # 2. Configure systemd-boot (replaces GRUB to avoid shim_lock issues)
 echo "==> [2/5] Setting up systemd-boot..."
 if ! bootctl is-installed &> /dev/null; then
    bootctl install
    echo "✓ systemd-boot installed successfully."
 else
    bootctl update
    echo "✓ systemd-boot is up to date."
 fi

 # 3. Check and Enroll Keys if in Setup Mode
 echo "==> [3/5] Checking Secure Boot status..."
 STATUS_OUTPUT=$(sbctl status 2>&1 || true)
 echo "$STATUS_OUTPUT"
 echo ""

 if echo "$STATUS_OUTPUT" | grep -q "Setup Mode:.*Enabled"; then
    echo "✓ Firmware is in Setup Mode."

    # Create keys if not already present
    if [ ! -d "/var/lib/sbctl/keys" ]; then
        echo "--> Creating custom Secure Boot keys..."
        sbctl create-keys
    else
        echo "✓ Custom Secure Boot keys already exist in /var/lib/sbctl/keys."
    fi

    # Enroll keys with Microsoft OEM vendor certificates
    echo "--> Enrolling keys into UEFI NVRAM (with Microsoft OEM certs)..."
    sbctl enroll-keys -m
    echo "✓ Keys enrolled."
 else
    echo "ℹ Firmware is not in Setup Mode (Keys are already enrolled or locked)."
 fi

 # 4. Sign all UKI and bootloader EFI binaries
 echo "==> [4/5] Signing boot binaries and saving to sbctl database..."

 # Critical bootloader & UKI paths
 BOOT_FILES=(
    "/boot/EFI/systemd/systemd-bootx64.efi"
    "/boot/EFI/BOOT/BOOTX64.EFI"
    "/boot/EFI/Linux/arch-linux-lts.efi"
    "/boot/EFI/Linux/arch-linux-lts-fallback.efi"
    "/boot/vmlinuz-linux-lts"
 )

 for file in "${BOOT_FILES[@]}"; do
    if [ -f "$file" ]; then
        echo "--> Signing $file..."
        sbctl sign -s "$file" || true
    fi
 done

 # Sign any additional unsigned EFI binaries found on the ESP
 echo "--> Checking for any remaining unsigned EFI binaries..."
 sbctl verify 2>&1 | awk '/not signed/ {print $2}' | while read -r unsigned_file; do
    if [ -n "$unsigned_file" ] && [ -f "$unsigned_file" ]; then
        echo "--> Signing $unsigned_file..."
        sbctl sign -s "$unsigned_file" || true
    fi
 done

 # 5. Verify all signatures
 echo ""
 echo "==> [5/5] Verifying signatures:"
 sbctl verify

 echo ""
 echo "================================================================="
 echo " Secure Boot configuration completed!"
 echo ""
 echo " If Secure Boot is not yet enabled in your firmware:"
 echo " 1. Run: systemctl reboot --firmware-setup"
 echo " 2. In BIOS/UEFI settings, set 'Secure Boot' -> 'Enabled'"
 echo " 3. Save and boot into Arch Linux"
 echo " 4. Check status with: sbctl status"
 echo "================================================================="
diff --git a/SB-README.md b/SB-README.md
Problem	Cause	Solution
`prohibited by secure boot policy` (GRUB error)	GRUB shim_lock module	Switch to `systemd-boot` (`sudo bootctl install`) and sign `systemd-bootx64.efi`.
`Firmware is not in setup mode`	UEFI keys not cleared	Reboot to BIOS (`systemctl reboot --firmware-setup`) and clear Secure Boot keys.
System won't boot after enabling Secure Boot	Bootloader / UKI not signed	Temporarily disable Secure Boot in BIOS, boot into Arch Linux, run `sudo sbctl sign-all`, verify with `sudo sbctl verify`, and re-enable Secure Boot.
External monitor / GPU doesn't show video	Missing Microsoft OEM certs	Re-enroll keys with `-m`: `sudo sbctl enroll-keys -m`.
	#!/usr/bin/env bash
	# ==============================================================================
	# Arch Linux Secure Boot Setup Script (systemd-boot + UKI + sbctl)
	# ==============================================================================
	set -euo pipefail

	# Ensure script is executed with root privileges
	if [ "$EUID" -ne 0 ]; then
	echo "This script requires root privileges. Elevating with sudo..."
	exec sudo "$0" "$@"
	fi

	echo "================================================================="
	echo " Arch Linux Secure Boot Configuration (systemd-boot + UKI) "
	echo "================================================================="
	echo ""

	# 1. Install sbctl
	if ! command -v sbctl &> /dev/null; then
	echo "==> [1/5] Installing sbctl..."
	pacman -S --needed --noconfirm sbctl
	else
	echo "==> [1/5] sbctl is already installed."
	fi

	# 2. Configure systemd-boot (replaces GRUB to avoid shim_lock issues)
	echo "==> [2/5] Setting up systemd-boot..."
	if ! bootctl is-installed &> /dev/null; then
	bootctl install
	echo "✓ systemd-boot installed successfully."
	else
	bootctl update
	echo "✓ systemd-boot is up to date."
	fi

	# 3. Check and Enroll Keys if in Setup Mode
	echo "==> [3/5] Checking Secure Boot status..."
	STATUS_OUTPUT=$(sbctl status 2>&1 \|\| true)
	echo "$STATUS_OUTPUT"
	echo ""

	if echo "$STATUS_OUTPUT" \| grep -q "Setup Mode:.*Enabled"; then
	echo "✓ Firmware is in Setup Mode."

	# Create keys if not already present
	if [ ! -d "/var/lib/sbctl/keys" ]; then
	echo "--> Creating custom Secure Boot keys..."
	sbctl create-keys
	else
	echo "✓ Custom Secure Boot keys already exist in /var/lib/sbctl/keys."
	fi

	# Enroll keys with Microsoft OEM vendor certificates
	echo "--> Enrolling keys into UEFI NVRAM (with Microsoft OEM certs)..."
	sbctl enroll-keys -m
	echo "✓ Keys enrolled."
	else
	echo "ℹ Firmware is not in Setup Mode (Keys are already enrolled or locked)."
	fi

	# 4. Sign all UKI and bootloader EFI binaries
	echo "==> [4/5] Signing boot binaries and saving to sbctl database..."

	# Critical bootloader & UKI paths
	BOOT_FILES=(
	"/boot/EFI/systemd/systemd-bootx64.efi"
	"/boot/EFI/BOOT/BOOTX64.EFI"
	"/boot/EFI/Linux/arch-linux-lts.efi"
	"/boot/EFI/Linux/arch-linux-lts-fallback.efi"
	"/boot/vmlinuz-linux-lts"
	)

	for file in "${BOOT_FILES[@]}"; do
	if [ -f "$file" ]; then
	echo "--> Signing $file..."
	sbctl sign -s "$file" \|\| true
	fi
	done

	# Sign any additional unsigned EFI binaries found on the ESP
	echo "--> Checking for any remaining unsigned EFI binaries..."
	sbctl verify 2>&1 \| awk '/not signed/ {print $2}' \| while read -r unsigned_file; do
	if [ -n "$unsigned_file" ] && [ -f "$unsigned_file" ]; then
	echo "--> Signing $unsigned_file..."
	sbctl sign -s "$unsigned_file" \|\| true
	fi
	done

	# 5. Verify all signatures
	echo ""
	echo "==> [5/5] Verifying signatures:"
	sbctl verify

	echo ""
	echo "================================================================="
	echo " Secure Boot configuration completed!"
	echo ""
	echo " If Secure Boot is not yet enabled in your firmware:"
	echo " 1. Run: systemctl reboot --firmware-setup"
	echo " 2. In BIOS/UEFI settings, set 'Secure Boot' -> 'Enabled'"
	echo " 3. Save and boot into Arch Linux"
	echo " 4. Check status with: sbctl status"
	echo "================================================================="