Secure Boot
Secure Boot lets the firmware refuse to start any boot image this machine hasn’t signed. ShedOS does it with a key of your own — minted on the box and kept on its disk. It is opt-in: a fresh install boots fine without it, and you turn it on when you want it.
It is also the middle step of a three-part story. Disk encryption protects your data when the machine is off; Secure Boot proves the machine only ever starts your boot images; and once both hold, passwordless unlock lets the TPM type the passphrase for you on a boot it can verify. Each step is optional, each builds on the one before.
Your firmware ships with factory keys from Microsoft and the vendor, and a fresh ShedOS install is unsigned — nothing on it matches those keys. If you flip Secure Boot on before enrolling, the firmware refuses every boot entry and shows something like “Operating System Loader failed signature verification”. Nothing is damaged; see If you enabled it too early below. The right first move is the opposite one: delete the factory keys, then let shedman secureboot enroll arm the firmware for you.
How it works
ShedOS boots through Limine, which hands off to a Unified Kernel Image — the kernel, its initramfs, and the command line bundled into one signed file. When you enroll, ShedOS mints this machine’s own Secure Boot key, signs every boot image with it, and only then arms the firmware. From that point the firmware checks each image against your key and refuses anything that doesn’t match.
The key never leaves the machine, and your box signs its own boot images instead of relying on a vendor to vouch for them.
Turning it on
1. Put the firmware in Setup Mode. Reboot into your firmware setup (usually F2, F10, Del, or Esc at the vendor logo) and find the Secure Boot section. You are looking for the option that clears or deletes the Secure Boot keys — vendors word it differently:
- Dell: Expert Key Management → tick Enable Custom Mode → Delete All Keys
- Lenovo: Security → Secure Boot → Reset to Setup Mode
- ASUS/MSI and many others: Key Management → Clear Secure Boot Keys (or Delete PK)
Deleting the Platform Key is what puts the firmware in Setup Mode. Leave the Secure Boot Enable toggle alone for now. Save and boot back into ShedOS — the machine boots normally, because a firmware with no keys enforces nothing.
2. Enroll. From the desktop:
sudo shedman secureboot enrollThis mints the machine’s key, signs the whole boot chain, verifies every image, and arms the firmware as its last step. If anything fails before that, Secure Boot stays off and the machine still boots — enrollment never leaves you with firmware that rejects its own kernel.
3. Reboot and check.
sudo shedman secureboot statusOn a machine that enrolled cleanly it prints:
Secure Boot: on
keys: set up for this machine
boot images: 4 signed and validThe Secure Boot state and your keys show without sudo; reading the signed images needs root, because they sit on the root-only boot partition. If it says Secure Boot is still off, your firmware keeps a separate Secure Boot Enable toggle — reboot into the firmware and switch it on; your keys are already in place, so the machine keeps booting.
By default the firmware also keeps trusting the Microsoft certificate, so the signed firmware on some discrete GPUs and network cards still loads. Add --shedos-only to trust your key alone — though some of that hardware may then fail to start.
Requiring Setup Mode is deliberate. The machine runs its unsigned images perfectly until you opt in, so there is no way to half-enroll and strand yourself.
If you enabled it too early
You flipped Secure Boot on in the firmware before enrolling, and now the machine shows “Operating System Loader failed signature verification” (or “All bootable devices failed Secure Boot verification”) instead of booting. Your disk and data are untouched — the firmware is simply refusing to start unsigned images, which is its job.
Reboot into the firmware setup and either switch Secure Boot Enable back off (the machine boots exactly as before), or better, delete the Secure Boot keys as described in step 1 above — that also puts you in Setup Mode, which is where enrollment starts anyway. Boot back into ShedOS and run sudo shedman secureboot enroll to do it in the right order.
Checking and re-signing
sudo shedman secureboot status # Secure Boot state, your keys, and image signatures
sudo shedman secureboot verify # re-check every signed image; non-zero if anything is wrongBoth are read-only. Without sudo they still report the Secure Boot state, but reading the signed images on the boot partition needs root. After a key change, re-sign the images with sudo shedman secureboot sign, or rebuild and re-sign a missing one with sudo shedman secureboot repair.
Turning it off
sudo shedman secureboot disableThis clears the machine’s keys and returns the firmware to Setup Mode, so it stops enforcing Secure Boot. The images you already signed still boot — nothing breaks, the firmware just stops checking.
Booting rescue media
Once Secure Boot is on, the firmware rejects anything unsigned — including a stock ShedOS install USB or another distro’s live media. To boot one, turn Secure Boot off in your firmware setup (or run sudo shedman secureboot disable from a working system first), do what you need, then re-enroll. The signed recovery entry in the boot menu keeps working under Secure Boot; it unlocks an encrypted disk with the passphrase, not the TPM.
Secure Boot is also what makes passwordless unlock possible — the TPM releases the disk key only against a boot chain it can verify.