Upgrading legacy boot to secure boot

psolus

Hello, I have legacy boot of Solus on my desktop machine. I just installed Solus on someone's Windows laptop erasing the whole disc and with secure boot, with no problems, installing the Solus boot certificate as per here:
https://help.getsol.us/docs/user/quick-start/installation/secure-boot/

I noticed in that article that perhaps I could fix up my desktop machine to use Secure boot!
https://help.getsol.us/docs/user/quick-start/installation/secure-boot/#enabling-secure-boot-on-an-existing-install
I checked clr-boot-manager as per the above and got

# eopkg info clr-boot-manager
Installed package:
Name                : clr-boot-manager, version: 3.6.0, release: 38

so then I rebooted, but was unable to find anything but "Windows boot manager" in the (f12 opened) boot menu under secure boot (and it showed legacy options too). So after a legacy reboot I ran

# clr-boot-manager update

and rebooted again. Same outcome.

The BIOS told me:

XPS 8900
System Bios 2.9.1
ePSA: Build 4302.15 UEFI ROM

Am I out of luck?

ℹ Moderator Note
I have edited your post to have the code output in a code fence.
Please always use the code button or manually add 3 backticks before and after code blocks.
This makes it a lot more readable. Thanks.
TraceyC

BuzzPCSOS

psolus It is late so I might have missed something or misunderstood a lot more.
It sounds like you are using Legacy Boot (MBR partition GRUB & BIOS) you cannot use secure boot from that point.
For secure boot to work you must make changes in your BIOS to switch off legacy and enable UEFI (more or less) and then reformat your hard drive (GPT format, UEFI boot).
Basically wipe and reinstall.
A UEFI boot system (GPT) will not see data on a legacy drive (MBR). I think it might apply the other way round too.
This is not a "in depth" answer but I hope it might give you an idea of what to look for and what is involved to make the conversion.
Lots of computers with the Legacy/UEFI choice had OEM software installed in Legacy mode but the BIOS would default to UEFI boot when the BIOS battery failed. This meant that at some point your PC would display "Operating system not found" or words to that effect. Changing the battery and switching back to legacy would fix the issue but BIOS battery failure acted as a sort of built-in obsolescence for many computers.

brent

BIOS recognizes the UEFI so we have a conflict as explained above. Whether you choose grub or uefi, you gotta make it all right in your BIOS before any install...or choose UEFI install...

...that all that said the title is misleading here. "so then I rebooted, but was unable to find anything but "Windows boot manager" in the (f12 opened) boot menu under secure boot (and it showed legacy options too)" clearly says you can't find the bootloader or boot solus. your title says upgrading secure boot.

SO like Buzz I feel like I'm missing something.

I only have three observations:
1) reinstall making sure your bios is dialed in to Legacy first. Laptops are bat**it crazy. CSM on or CSM off it does not matter. Only one will work and there is no consistency.
2) If Solus nuked WIN and installed itself how do you still have a WIN bootloader? Like Buzz said ^^ I format the disk before I let Solus (or any distro) format the disk in install. superstitious but it's always worked..
3) I would suggest go back to help page and type chroot and restore the bootloader there (it will work) but only if you have the legacy/uefi thing cleared up and after you have the did-I-make-my-bios-ready?-thing cleared up.

Missing bootloader is a headache. Go back thru all the steps Buzz mentioned. At the end of the day for any fresh install you have to 1) make it right with target disk and 2) make it right with the BIOS. Not sure any distro's installer can make sure your BIOS is copacetic.
2 cents

psolus

I have a working legacy boot installation of Solus. I've been using Solus for years.

The article

https://help.getsol.us/docs/user/quick-start/installation/secure-boot/#enabling-secure-boot-on-an-existing-install

has the title at the anchor at the end of the URL of

Enabling Secure Boot on an existing install

and then says

"If you already have Solus installed and wish to enable Secure Boot then there is one extra step you must perform BEFORE continuing with Enrolling the Solus Certificate as normal."

as if my installation could be semi-automatically made into a UEFI installation. So without investigation I tried it out and of course it doesn't work.

Apparently this part of the article only applies to a limited context that doesn't include legacy boot but doesn't say so, misleading a naive reader, me say.

It would be nice to state the context just there. Not just "Solus installed" but "Solus installed with as yet insecure UEFI boot" or whatever the exact state of play is supposed to be for that part of the article to be correct.

psolus

I just re-read everything in this thread. To be clear, while the instructions in the article didn't work for reasons you made clear, I had no problem just rebooting back in legacy mode and having it be the default.

BuzzPCSOS

psolus Good, well done. I'm glad you are back running again.
I think, like me, when you first installed Solus the installer was happy to install MBR/Legacy. When the installer was updated to Calamares the ability to make an easy Legacy install went away. This seems to be a Calmarares thing as it will always attempt to install to GPT/UEFI as some Legacy BIOS systems are not fussy and will boot anyway. I have never owned one of these less fussy PCs so had to learn how to manually format and partition the hard drive for MBR/Legacy boot. I have the same problem with all the mainstream Linux distros that use the Calamares installer.
Generally UEFI is a faster and less error prone boot method. If you can use it you probably should.
To be fair the second paragraph of the article states the requirement
"Note that this only applies to machines with UEFI firmware, if your machine uses the older BIOS firmware you can safely ignore this article. If you wish to avoid having to do this step then you may disable Secure Boot in your machine's UEFI firmware interface."
I guess we all make the mistake of skipping the boring bits ;-)
I hope you continue to enjoy Solus, the forum and the OS are the best I have found.

alfisya

psolus Technically there is note at the top of the article that warn you about this:

Note that this only applies to machines with UEFI firmware, if your machine uses the older BIOS firmware you can safely ignore this article. If you wish to avoid having to do this step then you may disable Secure Boot in your machine's UEFI firmware interface.

But you are right, we probably should reiterate that note on the section you linked. If you have the time, could you file an issue on Help Center repo. So, it is being monitored and something we can improve on.

This is also a call for anyone want to help writing documentation for Solus. This might be a good first issue for anyone interested 🙂. Anyway cheers!

psolus

alfisya

I can write some documentation for Solus depending upon the topic. Do I really have to get a github account to do that? The installation instructions really need a rewrite for a lot of reasons. I could elaborate. Can I communicate directly with you in some fashion? You're Solus Staff, so you have my email address.

psolus

Naively I don't know how to read the text "this only applies to machines with UEFI firmware" in a way that rules out my case. It seems my machine counts as having UEFI firmware because I found on boot BIOS setup has a checkbox for UEFI boot and a checkbox for secure boot that I checked when going through this exercise to move to secure boot that didn't work, instead of checking the "legacy boot" checkbox which is the setting I have been using. So it seems the instructions still don't rule out my case.

alfisya

psolus Do I really have to get a github account to do that?

Yes, you have to. We do development in public setting. If you have any idea, you have to present it publicly. If you want to contribute documentation, you can do so by following the guide in Help Center repo.

psolus Can I communicate directly with you in some fashion?

Yes you can. You can reach out to me via matrix (@alfisya:matrix.org) or email alfi@getsol.us .