I want to create a Ubuntu bootable USB flash and install my apps in that, then pass USB to any other person. they should run Ubuntu from USB flash and run my applications from it, so that nobody could change Ubuntu's kernel modules and also my application's modules and I want to prevent booting Ubunto if one of that modules was changed.
I think I have two options to achieve my purpose, first, UEFI bootloader programming and checks hash of USB contents through my customized bootloader, second, Use secure boot feature of UEFI.
I prefer second option because I think secure boot does everything I want and it is much easier than the first option, but I couldn't find any tutorial for creating secure boot enabled USB flash(with only my keys).
I will appreciate you if you could provide a step-by-step tutorial for clear default keys, enroll my keys, enabling secure boot for flash disk, and everything else I will need.