Grub secure boot

[atomic siren]

Grub is a modular bootloader and it is not allowed to load modules when secure boot is enabled

Solution is to set USE=secureboot and let portage build for you a non-modular version of grub and install that to the ESP, you'll also want to set GRUB_CFG in order to install the config file to the expected location

There are instructions for this in the handbook

[median jay]

tried to build grub with use secure boot, but it's saying Can't load key from file ''. I used sbctl to sign things

Grub looks too... hard?

is it worth?

I'm trying not to use systemd-boot, because I already know how to use it and I want to learn a new system with new tools

but honestly it (grub) looks really bad code or just not intuitive

I thin I'll try UKI or Refind

Can someone give some personal experience about them? I want encryption in root and secureboot without fighting my own machine

[atomic siren]

Then your SECUREBOOT_SIGN_CERT or SECUREBOOT_SIGN_KEY settings in make.conc are probably wrong

Sbctl is not the recommended way to do this, especially with grub

UKI is not a solution, you'll still need a bootloader (or load from uefi directly)