Secure Boot

Caution

Some device firmware (OpROMs) requires its own/Microsoft’s key to work with Secure Boot enabled. Firmware may not be able to load which can soft-brick your machine or disable display output, leaving you unable to see the UEFI settings menus and revert these changes. In that case you will need to reset your computer’s UEFI or re-flash it from a bricked state.

If you have the option to enable and enroll custom keys, it is highly recommended that you do so in order to protect your encrypted data from boot-chain attacks.

AstrOS ships two sets of keys and lets you choose which to enroll:

Set	Contains	Use when
astros+microsoft	AstrOS keys plus Microsoft’s UEFI and Windows certificates	Hardware with Microsoft-signed OpROMs
astros	AstrOS keys only	Virtual machines, or hardware you have confirmed has no Microsoft-signed OpROMs

Read the section below to work out which one applies to your machine.

Check Hardware for OpROM signatures

Detailed Guide: Arch Wiki

Enter the following command to check for devices with OpROM: If so, look at the Detailed Guide in the Arch Wiki to determine if any Microsoft keys are used.

find /sys/devices/ -name rom

If this returns anything, or if you are unsure, choose astros+microsoft. Discrete graphics cards, storage controllers and network adapters commonly carry firmware signed by Microsoft’s UEFI CA. Enrolling astros alone on such a machine means that firmware will refuse to load, which is the soft-brick scenario described above.

Setup Mode

In order for the option to enroll AstrOS’s own keys to appear, the system’s Secure Boot needs to be in Setup Mode.

To put firmware in Setup Mode, enter firmware setup utility and find an option to delete or clear certificates.

Enroll

Note

Do this before the first boot. If you are doing this after the first boot, make sure you have your recovery key ready. You will need to re-enroll the TPM afterwards.

Remember to enable Secure Boot after enrolling the keys.

Once the firmware is in Setup Mode, systemd-boot will show one entry per key set:

• Enroll Secure Boot keys: astros+microsoft
• Enroll Secure Boot keys: astros

Select the one that matches your hardware, then confirm. You will receive a warning that this could soft-break your machine. This is the previously mentioned problem of some ROMs being signed with Microsoft’s keys.