Skip to content

fix: Add steps for importing the secureboot key #399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Exponent64 wants to merge 2 commits into
base: live
Choose a base branch
from
+46 −1
Open

fix: Add steps for importing the secureboot key #399

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bb46bca
Add steps for importing the secureboot key
Exponent64 Aug 22, 2026
494a50e
Remove mention to discord server
Exponent64 Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 46 additions & 1 deletion content/INSTALL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ permalink: /install
- [Ignition (Server)](#ignition)
- [Rebase (IoT)](#rebase)
- [Rebase (ARM64 - Beta)](#arm64)
- [Importing SecureBoot key](#key)
- [Post-install](#post-install)

<hr>
Expand Down Expand Up @@ -129,7 +130,9 @@ You can use our [example.butane](https://github.com/secureblue/secureblue/blob/l

Install Fedora IoT using one of the [official methods](https://fedoraproject.org/iot/download).

Once Fedora IoT is installed, rebase to secureblue by selecting an appropriate image from [this list](https://secureblue.dev/images#iot), and then running the following command:
Before rebasing to secureblue IoT, you need to temporarily disable SecureBoot. Otherwise, if you do not want or cannot disable SecureBoot, you need to follow [these steps](#key).

Once you are ready, rebase to secureblue IoT by selecting an appropriate image from [this list](https://secureblue.dev/images#iot), and then running the following command:

```
sudo bootc switch ghcr.io/secureblue/${IMAGE_NAME}:latest
Expand All @@ -144,6 +147,48 @@ Some of our images have Beta support for the ARM64 / aarch64 architecture. Consu
sudo bootc switch ghcr.io/secureblue/${IMAGE_NAME}:latest
```

### [Importing SecureBoot key](#key)
{: #key}

You only need to follow these steps if you are rebasing from a non-secureblue image and do not want to or cannot disable SecureBoot. If you are a CoreOS user, you can skip these steps if using our example Butane file.

Download the secureblue key:

```
curl -O https://raw.githubusercontent.com/secureblue/secureblue/refs/heads/live/files/system/usr/share/pki/akmods/certs/akmods-secureblue.der
```

Verify the integrity of the downloaded key:

```
sha256sum akmods-secureblue.der
```

Which should give the following output:

```
fb8491059eabecf332f6a9e01e3aa35f0832f2f4d43df3f6f5ce2dfdac0ba9a8 akmods-secureblue.der
```

If your output does not match the expected result, please open a [GitHub issue](https://github.com/secureblue/secureblue/issues) reporting your findings.

For convenience, disable the timeout in the mokutil UEFI menu UI:

```
sudo mokutil --timeout -1
```

Finally, import the secureblue key:

{% include alert.html type='note' content='The next command will prompt for a MOK password. Input "secureblue".' %}

```
sudo mokutil --import akmods-secureblue.der
```

At next reboot, the mokutil UEFI menu UI will be displayed (*QWERTY* keyboard input and navigation).
Then, select "Enroll MOK", and input "secureblue" as the password.

<hr>

## [Post-install](#post-install)
Expand Down