Grub works but OS won't load after enabling secure boot.

HuangLinBao · 2025-07-30 04:15:58

I got recently into installing arch Following this YouTube Tutorial https://www.youtube.com/watch?v=FxeriGuJKTM (I chose the manual installation method). And I did that with secure boot Off, When I enabled it back I noticed that it won't get me to grub because of an invalid signature. That's when I decided to look up the issue. I found these two links in the wiki
https://wiki.archlinux.org/title/Unifie … _Boot#shim

https://wiki.archlinux.org/title/GRUB#S … ot_support (Here I found that I should follow the steps in the first link first). And I didn't reach to this stage yet because the first link said that it's enough and my machine should be booted in secure boot before proceeding here.

I followed them noticing that the paths I have weren't similar to the paths in the guide,

eg: EFI partition is located in esp/EFI/BOOT/BOOTx64.EFI according to the guide but in my case it was /boot/EFI/EFI/Arch/BOOTx64.EFI. I continued based on the structure I have on my machine for now. The progress I got is that GRUB loads fine, but when I choose Arch I don't boot into the partition as it fails. I have my doubts that LUKS encryption I did over the root partition has to do with it somehow.

my lsblk output is

I really need some guidance for that issue, if you can link me to other articles that may help or if you can help it would be appreciated.

NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
nvme0n1
├─nvme0n1p1
│ ntfs 51ADF2EC27CFACC9
└─nvme0n1p2
ntfs 482668072667F3FA
nvme1n1
├─nvme1n1p1
│ vfat FAT32 337C-6149 3G 0% /boot/EFI
├─nvme1n1p2
│ ext4 1.0 6c29172e-18c5-46ed-ae38-555e1e6dd462 1G 40% /boot
└─nvme1n1p3
│ crypto 2 2a315372-0a9e-4332-b100-9a51c5634748
└─volgroup0
│ LVM2_m LVM2 1q2Ide-TOIM-LYBP-cdTQ-ivK7-l60Q-WvLSZA
├─volgroup0-lv_root
│ btrfs ed076ba7-6f52-4cca-a7df-c6d0914ac6df 39.7G 20% /
└─volgroup0-lv_home
btrfs 1a9f643a-b409-4d52-bb42-aac7eac8f000 493.7G 1% /home

And bootctl returns

Firmware: n/a (n/a)
Firmware Arch: x64
Secure Boot: disabled (setup)
TPM2 Support: yes
Measured UKI: no
Boot into FW: supported

Current Boot Loader:
Product: GRUB 2.13
Features: ✗ Boot counting
✗ Menu timeout control
✗ One-shot menu timeout control
✗ Default entry control
✗ One-shot entry control
✗ Support for XBOOTLDR partition
✗ Support for passing random seed to OS
✗ Load drop-in drivers
✗ Support Type #1 sort-key field
✗ Support @saved pseudo-entry
✗ Support Type #1 devicetree field
✗ Enroll SecureBoot keys
✗ Retain SHIM protocols
✗ Menu can be disabled
✗ Multi-Profile UKIs are supported
✓ Boot loader set partition information
Partition: /dev/disk/by-partuuid/ec368736-a903-4f27-930b-ca6b1ae12294

Last edited by HuangLinBao (2025-07-30 04:17:20)

StarWolf3000 · 2025-07-30 06:32:59

Do not use any external guides, use the official one from the Wiki: https://wiki.archlinux.org/title/Installation_guide

HuangLinBao · 2025-08-01 06:29:03

I did a fresh reinstall.
I followed the official guide, and for the partitioning scheme I chose to have btrfs on my root partition

So the set of parted commands I ran was like this

parted /dev/nvme0n1 --script mklabel gpt

parted /dev/nvme0n1 --script mkpart ESP fat32 1MiB 2049MiB
parted /dev/nvme0n1 --script set 1 esp on

parted /dev/nvme0n1 --script mkpart primary ext4 2049MiB 6145MiB

parted /dev/nvme0n1 --script mkpart primary btrfs 6145MiB 100%

created subvolumes

btrfs subvolume create /mnt/@
btrfs subvolume create /mnt/@home
btrfs subvolume create /mnt/@log

mounted everything

mount -o noatime,compress=zstd,subvol=@ /dev/nvme0n1p3 /mnt
mount -o noatime,compress=zstd,subvol=@home /dev/nvme0n1p3 /mnt/home
mount -o noatime,compress=zstd,subvol=@log /dev/nvme0n1p3 /mnt/var/log
mount /dev/nvme0n1p2 /mnt/boot
mount --mkdir /dev/nvme0n1p1 /mnt/boot/efi

and ran pacstrap

pacstrap -K /mnt base linux linux-firmware btrfs-progs nano vim

and generated new fstab config

genfstab -U /mnt >> /mnt/etc/fstab

and in chroot:

I chose to install linux-lts linux-headers linux-lts-headers

as well as nvidia nvidia-utis and nvidia-lts

all went well.

I edited mkinitcpio config and added the btrfs hook

so far everything went smooth.

I did install refind, ran refind-install and payed attention to the PARTUUID and UUID point.

first I left the config on its own with root pointing to /dev/nvme0n1p3. I fell back to the emergency shell.
booted back again to notice the device name changes between boots so my ssd is now nvme1n1p3

I added the PARTUUID in refind_linux.conf and exited to reboot again; no use, it still went to the emergency shell.
went back again, replaced PARTUUID with UUID because I thought it compared to fstab config. Still no use.

That's where I'm currently stuck

iwuvkittens · 2025-08-19 17:15:59

busybox shell? grab logs of what is exactly putting you in there, the contents of your fstab, lsblk -f output, and the refind config file. upload everything to 0x0.st and attach the link(s) here. also what is nvme0n1p1 and nvme0n1p2, why are you specifiying two esps when you only made 1 with parted after wiping everything with mklabel, it's not a good idea to mount to /boot/efi since it's nested

in your case you would be better off mounting the esp to /efi and removing the ext4 partition just have /boot on btrfs no need for a separate partition see esp mount points for more info

Last edited by iwuvkittens (2025-08-19 17:32:32)

Arch Linux

#1 2025-07-30 04:15:58

Grub works but OS won't load after enabling secure boot.

#2 2025-07-30 06:32:59

Re: Grub works but OS won't load after enabling secure boot.

#3 2025-08-01 06:29:03

Re: Grub works but OS won't load after enabling secure boot.

#4 2025-08-19 17:15:59

Re: Grub works but OS won't load after enabling secure boot.

Board footer