Out of curiosity, I'm trying out systemd-boot on my laptop which has UEFI with secure boot. The default GRUB installation is working fine.
For systemd-boot, most searches lead to this page. This involves installing systemd-boot with bootctl
, creating loader.conf
, creating a kernel postinst zz-update-systemd-boot
script. Everything looks fine till here though I don't understand why systemd-boot doesn't have an ext4 fs driver to access the kernels. Anyway, as expected this fails to boot because of secure boot.
The secure boot section of this page has the PreLoader.efi
& HashTool.efi
setup. After following the steps, the system boot shows the systemd-boot menu but after choosing Ubuntu this error is thrown:
EFI stub: UEFI Secure Boot is enabled.
As far as I understand, the PreLoader
is a signed binary that is accepted by UEFI. This then loads the loader.efi
(renamed systemd-bootx64.efi
) whose hash was enrolled. This loads the vmlinuz
kernel whose hash was also enrolled. So, it appears that the secure chain is fine but boot still fails. It appears that Canonical's signature to the kernel does not play a role here.
How to get this working and have I understood the secure aspects correctly?