12.10 UEFI Secure Boot install

Question

Now that Secure Boot is supported, what special instructions does one have to follow to install Ubuntu 12.10 on a UEFI Secure Boot enabled PC shipped with Windows 8?

As I understand, 12.10 ships with signed GRUB2. I searched but cannot get past the "supported" statement. I am looking for specific instructions on registering Ubuntu keys to let the firmware boot Ubuntu.

UPDATE:

Thanks. SecureBoot in Ubuntu 12.10 gives me the answer. The Ubuntu first-stage EFI bootloader is signed by Microsoft. The last time I read, Ubuntu had plans to publish their own key which had to be registered in the firmware's database before installing. May be I did not track the story long enough to realize that it is not the case anymore.

Answer 1

Probably start here: help.ubuntu.com/community/UEFI

UEFI (~EFI) is a firmware interface that is widespread on recent computers, especially those more recent than 2010. It is intended to replace the traditional BIOS firmware interface that is prevalent on earlier machines. This page provides information about installing and booting Ubuntu using EFI, as well as about switching between EFI mode and legacy BIOS mode using Ubuntu.

---

UPDATE:

Ubuntu 12.10 is intended to be able to be used with Secure Boot.

Softpedia (Sep-2012) >> Canonical Unveils Plans for Ubuntu 12.10 Secure Boot

Canonical, through Jon Melamut, announced on September 20th that they will plan to implement support for Secure Boot in the upcoming Ubuntu 12.10 (Quantal Quetzal) operating system.

Therefore, after a discussion with Free Software Foundation, Canonical decided to drop the EFILinux bootloader implementation in favor of the GRUB2 bootloader one, signed with their own keys. ..

Muktware (Oct-2012) >> SecureBoot In Ubuntu 12.10

Ubuntu 12.10 is the first distro that supports the Secure Boot architecture by default. Canonical developers have spent a huge amount of time making sure that Ubuntu runs fine and without problems in all hardware. Steve Langasek, an Ubuntu developer has put forward a nice account in his blog, regarding how they are making Secure Boot supported.

closes with ..

Langasek says that they will backport the secure boot mechanism to Ubuntu 12.04 release as well, so that the LTS version can be installed in Secure Boot devices. So the next major service pack of Ubuntu Precise (12.04.2) will include support for SecureBoot.

Answer 2

1. First install Ubuntu-Secure-Remix-64bit (or Ubuntu12.10 64bit) and use Boot-Repair's Recommended Repair as described in the first paragraph of https://help.ubuntu.com/community/UEFI

2. If that fails, disable SecureBoot in your firmware as described here: https://help.ubuntu.com/community/UEFI#SecureBoot , and run Boot-Repair again.

Answer 3

There is a problem on some machines, particulary laptops - They don't appear to have the "Microsoft Windows UEFI Driver Publisher" public key installed in their BIOS to allow the signed Ubuntu boot loader (and other UEFI software such as ours) to run with Secure Boot option enabled. This is NOT the same key, which Microsoft use to sign their own UEFI Windows Boot Manager and it appears that some BIOS implementations only have this Microsoft exclusive public key.

The solution is either:

1: For Microsoft to sign third party UEFI binaries with the SAME key as they use for their own bootloader.

2: For BIOS vendors/computer hardware motherboard manufacturers to be sure they include the data to allow "Microsoft Windows UEFI Driver Publisher" signed binaries to work correctly.

On a Windows 8 machine, enter Mountvol Z: /S in an admin elevated command prompt box. Then in the command prompt do:

copy Z:\EFI\Microsoft*.efi C:\test

Where Z is an unused drive letter.

You can then check in (already created) C:\test folder the digital signatures on the Microsoft .efi files and see that the name of the key is different to the key they used to sign the Ubuntu boot loader.

The Ubuntu boot files can be found in X:\EFI\Boot where X is the CD drive letter.

This needs sorting out, and sorting quickly.

Our research indicates that of laptops tested so far, only ASUS laptops have the correct keys installed in their bios, but we haven't yet managed to check everyone. I am not mentioning here, the names of machines which won't work, but one is a similar name to the one which does!

Answer 4

Have posted a similar question six months ago and due to being unable to load kernel led to installing a non-linux alternative OS which due to losing the ESP and having no EFI shell or EFI GUI in my particular case has led to spending time in getting a working answer on how to manage an EFI install. Referring to your question previously led me to believe that using the 12.10 64bit iso would be a cure all but my problem has not been resolved. I am not a bug tracker or developer and did struggle to digest what was being referred to here which you found helpful too.

Since starting on the quest to make use of the EFI capabilities of my newest hardware have been spending more time on these very useful pages which includes a good synopsis of how to perform an Ubuntu install on a Secure Boot enabled machine and highlight there are other options other than relying on Grub2 and signed keys from Microsoft. Which your answer indicates as the be all and end all. Just thought would share this is not the case. As the last link shows using rEFInd and your own keys it is possible to manage a linux install with Secure Boot enabled. The alternative is to turn Secure Boot off. Hope you enjoy the reading as much as I!

Another useful source of helpful information regarding all things U/EFI is the wiki article here (which links to a EUFI page which scares me no end! Science fiction is not fiction!:p)