-
Disable Secure Boot.
-
Assuming that you have a bootable USB stick with PopOS, boot from it and install PopOS. I 've installed PopOS on the external drive.
-
Install reEFInd.
sudo add-apt-repository ppa:rodsmith/refind
sudo apt-get update
- Install shim and shim-signed and prevent them from updating. Do not install the latest version, as you might not be able to enroll your keys. Bug: rhboot/shim#143
wget http://archive.ubuntu.com/ubuntu/pool/main/s/shim/shim_13-0ubuntu2_amd64.deb
sudo apt-get install -f ./shim_13-0ubuntu2_amd64.deb
sudo apt-mark hold shim=13-0ubuntu2
wget http://archive.ubuntu.com/ubuntu/pool/main/s/shim-signed/shim-signed_1.34.9+13-0ubuntu2_amd64.deb
sudo apt-get install -f ./shim-signed_1.34.9+13-0ubuntu2_amd64.deb
sudo apt-mark hold shim-signed=1.34.9+13-0ubuntu2
- Run the rEFInd script and use the ubuntu signed shim file.
sudo refind-install --shim /usr/lib/shim/shimx64.efi.signed --localkeys
rEFInd will generate local signed keys and re-sign the rEFInd binaries with your own key too.
rEFInd will store the .key file in /etc/refind.d/keys (You will need that later)
- Copy the PopOS certificate to the EFI
sudo cp /var/lib/shim-signed/mok/MOK.der /boot/efi/EFI/refind/keys/popos.der
- Sign the bootloader and kernel. If the commands below don't work with sudo, sudo su - and run them as root.
cd /boot/efi/EFI/systemd/
sbsign --key /etc/refind.d/keys/refind_local.key --cert ../refind/keys/refind_local.crt --output systemd-bootx64-signed.efi systemd-bootx64.efi
cd ../<Your PopOS directory>/
sbsign --key /etc/refind.d/keys/refind_local.key --cert ../refind/keys/refind_local.crt --output vmlinuz-signed.efi vmlinuz.efi
mv vmlinuz.efi vmlinuz.efi.old
mv vmlinuz-signed.efi vmlinuz.efi
-
Reboot and enable Secure Boot.
-
Enroll your keys.
Once you boot again, you 'll see the MokManager program. Each of the long strings represents a disk partition. Select the partition where you have stored your keys.
Enroll refind_local.cer which is in /boot/efi/EFI/refind/keys and then enroll popos.der which is
in the same directory.
Finally, select continue boot.
- You should now see rEFInd's interface. You can verify that you have booted into rEFInd Secure Boot mode by going to About. Select the kernel you have signed before and click enter.
Error reading file vmlinuz.efi: No such file or directory