Create UEFI secureboot USB - Revision history

Prabuanand: added back the merge note referencing UEFI Secure Boot page instead of Create UEFI boot USB

2025-05-30T15:47:33Z

added back the merge note referencing UEFI Secure Boot page instead of Create UEFI boot USB

← Older revision		Revision as of 15:47, 30 May 2025
Line 1:		Line 1:
	This article explains how to create an [[UEFI]] boot USB with parted and rEFInd. Unfortunately the version of GRUB that ships with Alpine Linux did not work and Gummiboot only worked on one of two machines I tested. I will submit a PR for a rEFInd package and update these instructions to simplify them given time.		{{merge\|UEFI Secure Boot}} This article explains how to create an [[UEFI]] boot USB with parted and rEFInd. Unfortunately the version of GRUB that ships with Alpine Linux did not work and Gummiboot only worked on one of two machines I tested. I will submit a PR for a rEFInd package and update these instructions to simplify them given time.

	In this example we will use {{Path\|/dev/sdX}} and $HOME. This will be different depending on your system. Substitute the paths in the examples below as necessary.		In this example we will use {{Path\|/dev/sdX}} and $HOME. This will be different depending on your system. Substitute the paths in the examples below as necessary.

Prabuanand: removed the link to Create UEFI boot USB‎ page

2024-12-30T03:40:37Z

removed the link to Create UEFI boot USB‎ page

← Older revision		Revision as of 03:40, 30 December 2024
Line 1:		Line 1:
	~~{{merge\|Create UEFI boot USB}}~~This article explains how to create an UEFI boot USB with parted and rEFInd. Unfortunately the version of GRUB that ships with ~~ALpine~~ Linux did not work and Gummiboot only worked on one of two machines I tested. I will submit a PR for a rEFInd package and update these instructions to simplify them given time.		This article explains how to create an [[UEFI]] boot USB with parted and rEFInd. Unfortunately the version of GRUB that ships with Alpine Linux did not work and Gummiboot only worked on one of two machines I tested. I will submit a PR for a rEFInd package and update these instructions to simplify them given time.

	In this example we will use {{Path\|/dev/sdX}} and $HOME. This will be different depending on your system. Substitute the paths in the examples below as necessary.		In this example we will use {{Path\|/dev/sdX}} and $HOME. This will be different depending on your system. Substitute the paths in the examples below as necessary.

WhyNotHugo: Add category UEFI

2023-11-07T10:09:38Z

Add category UEFI

← Older revision		Revision as of 10:09, 7 November 2023
Line 65:		Line 65:
	Insert the USB into the target PC and boot. When prompted select to enroll key, navigate to alpine_local.cer and add it. Then select enroll hash navigate to efi/boot/grubx64.efi select it and add the hash. Now reboot and given a bit of luck it should launch alpine. This step is a bit more complex than it needs to be due to the binary distribution of refind already being signed by the authors key. Once rEFInd is packaged it should simplify this step.		Insert the USB into the target PC and boot. When prompted select to enroll key, navigate to alpine_local.cer and add it. Then select enroll hash navigate to efi/boot/grubx64.efi select it and add the hash. Now reboot and given a bit of luck it should launch alpine. This step is a bit more complex than it needs to be due to the binary distribution of refind already being signed by the authors key. Once rEFInd is packaged it should simplify this step.

	[[Category:Installation]]		[[Category:Installation]] [[Category:UEFI]]

Zcrayfish: /* Download and install rEFInd */ Changed a hyperlink to https

2023-07-26T21:38:06Z

Download and install rEFInd: Changed a hyperlink to https

← Older revision		Revision as of 21:38, 26 July 2023
Line 34:		Line 34:

	== Download and install rEFInd ==		== Download and install rEFInd ==
	Download the binary zip file of rEFInd from ~~http~~://www.rodsbooks.com/refind/getting.html. In this example we will use the current version of rEFInd, refind-bin-0.11.4.zip. There may be a more recent version of rEFInd available when you download.		Download the binary zip file of rEFInd from https://www.rodsbooks.com/refind/getting.html. In this example we will use the current version of rEFInd, refind-bin-0.11.4.zip. There may be a more recent version of rEFInd available when you download.

	{{Cmd \| cd /mnt/efi/boot		{{Cmd \| cd /mnt/efi/boot

Arrogance at 06:48, 30 May 2023

2023-05-30T06:48:11Z

← Older revision		Revision as of 06:48, 30 May 2023
Line 1:		Line 1:
	This article explains how to create an UEFI boot USB with parted and rEFInd. Unfortunately the version of GRUB that ships with ALpine Linux did not work and Gummiboot only worked on one of two machines I tested. I will submit a PR for a rEFInd package and update these instructions to simplify them given time.		{{merge\|Create UEFI boot USB}}This article explains how to create an UEFI boot USB with parted and rEFInd. Unfortunately the version of GRUB that ships with ALpine Linux did not work and Gummiboot only worked on one of two machines I tested. I will submit a PR for a rEFInd package and update these instructions to simplify them given time.

	In this example we will use {{Path\|/dev/sdX}} and $HOME. This will be different depending on your system. Substitute the paths in the examples below as necessary.		In this example we will use {{Path\|/dev/sdX}} and $HOME. This will be different depending on your system. Substitute the paths in the examples below as necessary.

Zcrayfish: Marked a dead link.

2021-12-20T22:54:22Z

Marked a dead link.

← Older revision		Revision as of 22:54, 20 December 2021
Line 42:		Line 42:

	== Copy signed shim ==		== Copy signed shim ==
	Download Matthew J. Garrett's signed shim from http://www.codon.org.uk/~mjg59/shim-signed/shim-signed-0.2.tgz. In this example we assume it is stored in your users download directory. Substitute the paths in the example below as necessary.		Download Matthew J. Garrett's signed shim from http://www.codon.org.uk/~mjg59/shim-signed/shim-signed-0.2.tgz{{dead link}}. In this example we assume it is stored in your users download directory. Substitute the paths in the example below as necessary.

	{{Cmd \| cd /mnt/efi/boot		{{Cmd \| cd /mnt/efi/boot

Invidian: Invidian moved page Create UEFI seureboot USB to Create UEFI secureboot USB: There is a typo in the title

2020-04-21T17:50:02Z

Invidian moved page Create UEFI seureboot USB to Create UEFI secureboot USB: There is a typo in the title

← Older revision	Revision as of 17:50, 21 April 2020
(No difference)

Emolitor: /* Install the Keys and Enroll Hash */

2018-12-31T10:39:25Z

Install the Keys and Enroll Hash

← Older revision		Revision as of 10:39, 31 December 2018
Line 63:		Line 63:

	== Install the Keys and Enroll Hash ==		== Install the Keys and Enroll Hash ==
	Insert the USB into the target PC and boot. When prompted select to enroll key, navigate to alpine_local.cer and add it. Then select enroll hash navigate to efi/boot/grubx64.efi select it and add the hash. Now reboot and given a bit of luck it should launch alpine.		Insert the USB into the target PC and boot. When prompted select to enroll key, navigate to alpine_local.cer and add it. Then select enroll hash navigate to efi/boot/grubx64.efi select it and add the hash. Now reboot and given a bit of luck it should launch alpine. This step is a bit more complex than it needs to be due to the binary distribution of refind already being signed by the authors key. Once rEFInd is packaged it should simplify this step.

	[[Category:Installation]]		[[Category:Installation]]

Emolitor: /* Unmount the partition */

2018-12-31T10:38:01Z

Unmount the partition

← Older revision		Revision as of 10:38, 31 December 2018
Line 61:		Line 61:
	Finally umount the disk		Finally umount the disk
	{{Cmd \| cd ~ && umount /mnt}}		{{Cmd \| cd ~ && umount /mnt}}

			== Install the Keys and Enroll Hash ==
			Insert the USB into the target PC and boot. When prompted select to enroll key, navigate to alpine_local.cer and add it. Then select enroll hash navigate to efi/boot/grubx64.efi select it and add the hash. Now reboot and given a bit of luck it should launch alpine.

	[[Category:Installation]]		[[Category:Installation]]

Emolitor: /* Sign the Bootloader and kernel with your key */

2018-12-31T10:29:56Z

Sign the Bootloader and kernel with your key

← Older revision		Revision as of 10:29, 31 December 2018
Line 53:		Line 53:

	== Sign the Bootloader and kernel with your key ==		== Sign the Bootloader and kernel with your key ==
	{{Cmd \| sbsign --key $HOME/alpine_local.key --cert $HOME/alpine_local.crt grubx64.efi		{{Cmd \| sbsign --key $HOME/alpine_local.key --cert $HOME/alpine_local.crt /mnt/efi/boot/grubx64.efi
	mv grubx64.efi.signed ~~grubx64.efi~~		mv /mnt/efi/boot/grubx64.efi.signed /mnt/efi/boot/grubx64.efi
	cd /mnt/boot		sbsign --key $HOME/alpine_local.key --cert $HOME/alpine_local.crt /mnt/boot/vmlinuz-vanilla
	sbsign --key $HOME/alpine_local.key --cert $HOME/alpine_local.crt vmlinuz-vanilla		mv /mnt/boot/vmlinuz-vanilla.signed /mnt/boot/vmlinuz-vanilla}}
	mv vmlinuz-vanilla.signed vmlinuz-vanilla}}

	== Unmount the partition ==		== Unmount the partition ==