Arch: Secure Boot for Grub + Windows dual-boot

SOURCE: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
^-- Mentions the potential for bricking a couple times.
SOURCE: https://www.reddit.com/r/archlinux/comments/10pq74e/my_easy_method_for_setting_up_secure_boot_with/
SOURCE: https://web.archive.org/web/20250116185859/https://www.reddit.com/r/archlinux/comments/10pq74e/my_easy_method_for_setting_up_secure_boot_with/

0. About my system:    <-- A mix of relevant and irrelevant info. The esp path = /efi is probably all that matters here. Just flexing the two-EFI setup that everyone should use (if not on a laptop) IMHO.

    Grub boot-loader to select Arch or Windows, installed to /boot/grub
    Linux-only EFI (at the end of D:\ drive) mounted to /efi
    Windows-only EFI (at the start of C:\ drive) mounted to /efi-win
    ^-- Needs to be mounted in /etc/fstab for os-prober to see it, to add Windows to the grub menu.

1. Gigabyte BIOS preparation for secure boot:

    Boot > Secure Boot:

        System Mode: Setup
        Secure Boot: Disabled
                     Not Active
        Secure Boot Mode: Custom

        NOTE: This is the default state i saw after updating the BIOS.
              This is the state you need to be in to configure Secure Boot with custom keys for Arch to boot.

              If not in this state then you can get here by setting [Secure Boot Mode: Custom] and selecting "Reset To Setup Mode".
              After the system reboots, re-enter BIOS and set Secure Boot: Disabled.

        ----

    --> For windows-only users, that do NOT intend to dual-boot:
        SOURCE: https://www.reddit.com/r/gigabyte/comments/rciwjd/comment/hnw0kdo/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

            If it says System Mode: User, then set Secure Boot: Enabled. Done.
            If it says System Mode: Setup,
                Set Secure Boot: Disabled
                    Secure Boot Mode: Custom      <-- Change this to Custom...
                    Secure Boot Mode: Standard    <-- ... Now change it to Standard.
                    <Select Yes to install Factory Defaults, causing a reboot>
                    Go back into BIOS. If it says System Mode: User, then set Secure Boot: Enabled. Done.
                    If you can't boot Windows then come back to BIOS and set Secure Boot: Disabled, and try all of this again?

2. Boot into Arch with Secure Mode: Setup + Secure Boot: Disabled.

3. Re-install GRUB to utilize Microsoft's CA certificates (as opposed to shim):

    NOTE: Make sure to use your esp mount point if its not /efi.

    For Secure Boot do this:

        $ sudo pacman -S grub efibootmgr os-prober
        $ sudo grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=Arch --removable --modules="tpm" --disable-shim-lock
        $ sudo grub-mkconfig -o /boot/grub/grub.cfg

    NOTE: This is what i did before using Secure Boot:

        $ sudo pacman -S grub efibootmgr os-prober
        $ sudo grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=Arch --removable
        $ sudo grub-mkconfig -o /boot/grub/grub.cfg

4. Add an environment variable so sbctl can find the EFI:

    Not 100% sure this step is needed.

    I was getting this error before adding the ESP_PATH environment variable:
        error: verification requested but nobody cares: (hd4,gpt6)/boot/grub/x86_64-efi/normal.mod.
        Entering rescue mode...
        grub rescue>

    But then i updated my BIOS to version F7 which has "Secure Boot Database Key Update: Enhances system security".
    I added the environment variable, said the magic words, and it worked?
    Its possible that the environment variable is not critical to sbctl finding the files and the new bios fixed the issue?

    /etc/environment

    #
    # SBCTL
    #
    # SEE: https://github.com/Foxboron/sbctl/issues/207#issuecomment-1479188897
    #     Foxboron
    #     >   sbctl should instead try to pull info from /boot, /efi, /boot/efi, check that they are mountpoints; and if they are, that they satisfy the set constraints (vfat, parttype, etc.).
    #     Not possible as we use lsblk and it acts on blockdevices and not mountpoints. I'm not re-writing it to support a setup where people mount the ESP three places on a system.
    # SEE: https://github.com/Foxboron/sbctl/issues/207#issuecomment-1652239359
    #     Foxboron
    #     If lsblk is reporting null I suspect udev has some issues. This isn't a sbctl issue, strictly speaking. You can set ESP_PATH manually.
    ESP_PATH=/efi

    ^-- Reboot after adding that to /etc/environment so the shell sees it, i.e. so $ echo $ESP_PATH displays "/efi".

5. Install the sbctl tool:

    $ sudo pacman -S sbctl

    Ignore these errors:
      -> Running post hook: [sbctl]
    Secureboot key directory doesn't exist, not signing!

6. Verify that you are in setup mode:

    $ sbctl status

    Installed:      ✗ sbctl is not installed
>   Setup Mode:     ✗ Enabled
    Secure Boot:    ✗ Disabled
    Vendor Keys:    none

7. Create your custom secure boot keys:

    $ sudo sbctl create-keys

    Created Owner UUID 79c89b78-022a-437b-a996-e562766537ef
    Creating secure boot keys...✓
    Secure boot keys created!

8. Enroll your custom keys (note -m is required to include Microsoft's CA certificates):

    $ sudo sbctl enroll-keys -m

    Enrolling keys to EFI variables...
    With vendor keys from microsoft...✓
    Enrolled keys to the EFI variables!

9. Verify that your keys have successfully been enrolled:

    $ sbctl status

    Installed:      ✓ sbctl is installed
    Owner GUID:     79c89b78-022a-437b-a996-e562766537ef
    Setup Mode:     ✗ Enabled
    Secure Boot:    ✗ Disabled
>   Vendor Keys:    microsoft

10. Check which files need to be signed for secure boot to work:

    $ sudo sbctl verify

    Verifying file database and EFI images in /efi...
    ✗ /efi/EFI/BOOT/BOOTX64.EFI is not signed

11. Sign all unsigned files:

    $ sudo sbctl sign -s /efi/EFI/BOOT/BOOTX64.EFI

    ✓ Signed /efi/EFI/BOOT/BOOTX64.EFI

    NOTE: If you get an error because of an issue with certain files being immutable. To make those files mutable run the following command for each file and reattempt to sign:
    $ sudo chattr -i /sys/firmware/efi/efivars/<filename>

12. Verify that everything has been signed:

    $ sudo sbctl verify

    Verifying file database and EFI images in /efi...
    ✓ /efi/EFI/BOOT/BOOTX64.EFI is signed

-----

13. Return to the BIOS:

    Set Secure Boot: Enabled

-----

14. Verify that secure boot is enabled:

    $ sbctl status

    Installed:      ✓ sbctl is installed
    Owner GUID:     79c89b78-022a-437b-a996-e562766537ef
    Setup Mode:     ✓ Disabled
>   Secure Boot:    ✓ Enabled
    Vendor Keys:    microsoft

-----

NOTE: sbctl comes with a pacman hook for automatic signing so you don't need to worry when you update your system.

NOTE: AI says do this to block LibreWolf/FireFox from TPM ID (idk if it works, did 2 seconds of research on this):

    about:config
    security.webauth.webauthn = false
    security.webauth.webauthn_enable_softtoken = false
    security.webauth.webauthn_enable_usbtoken = false
    security.webauth.webauthn_testing_allow_direct_attestation = false