0. Before we begin#

Lately I tried to install Fedora to replace Ubuntu to get rid of the snap s**t. And I got an idea from nowhere deciding to give systemd-boot a try, so that’s how the nightmare begins.

There are two separate trust operations:

1. EFI signing: firmware db trusts systemd-boot and your UKI.
2. Kernel-module signing: the NVIDIA modules are signed by a key the kernel trusts.

No MOK is needed when booting directly through systemd-boot, provided the module certificate is in firmware db and Fedora imports that key into a keyring accepted for module verification. The tutorials online are mainly about grub+shim and will often require you to enroll a MOK key.

If you are not interested in my install process and how I configured systemd-boot for secure boot, please skip chapter 0.

Installing Fedora#

The systemd-boot approach is only configurable using Everything netinst image (it is said that the offline images are also possible to do that, but with more complex steps). When you boots up from your usb-key, navigate to

Create keys:

1sudo sbctl create-keys

Enroll the sbctl keys while retaining Microsoft certificates:

1sudo sbctl enroll-keys -m

The -m matters when Microsoft-signed option ROMs, Windows, or other Microsoft-signed EFI components are needed.

Sign enrolled EFI files:

1sudo sbctl sign-all
2sudo sbctl verify