Skip to content

Instantly share code, notes, and snippets.

@mikaeldui

mikaeldui/CachyOS Kernel for Fedora with Secure Boot.md

Last active December 22, 2025 17:41
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save mikaeldui/bf3cd9b6932ff3a2d49b924def778ebb to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save mikaeldui/bf3cd9b6932ff3a2d49b924def778ebb to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. mikaeldui revised this gist Dec 6, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,7 +7,7 @@ First, make sure you have Secure Boot with `mokutil --sb-state`.

    *Note, there's a second way of doing this by using [`sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/), but I didn't want to wipe my Secure Boot keys.*

    Need help? Feel free to leave a comment below, contact me (@mikaeldui) on the [CachyOS Discord](https://discord.com/servers/cachyos-862292009423470592), or [send me an email](mailto:ed184999-8363-4f40-85c5-a4a40a1d71dc@bolinder.uk).
    Need help? Feel free to leave a comment below, contact me (@mikaeldui) on the [CachyOS Discord](https://discord.com/servers/cachyos-862292009423470592), or [send me an email](mailto:ed184999-8363-4f40-85c5-a4a40a1d71dc@bolinder.uk?subject=CachyOS%20Kernel%20for%20Fedora%20with%20Secure%20Boot&body=Dear%20Mikael%2C%0A%0A%5Binsert%20question%5D).

    # Installing the CachyOS Kernel
    Full instructions at https://github.com/CachyOS/copr-linux-cachyos
  2. mikaeldui revised this gist Dec 6, 2025. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,6 +7,8 @@ First, make sure you have Secure Boot with `mokutil --sb-state`.

    *Note, there's a second way of doing this by using [`sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/), but I didn't want to wipe my Secure Boot keys.*

    Need help? Feel free to leave a comment below, contact me (@mikaeldui) on the [CachyOS Discord](https://discord.com/servers/cachyos-862292009423470592), or [send me an email](mailto:ed184999-8363-4f40-85c5-a4a40a1d71dc@bolinder.uk).

    # Installing the CachyOS Kernel
    Full instructions at https://github.com/CachyOS/copr-linux-cachyos

  3. mikaeldui revised this gist Dec 6, 2025. 1 changed file with 11 additions and 0 deletions.
    11 changes: 11 additions & 0 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -24,21 +24,32 @@ We can self-sign the kernel by adding our key as a MOK (Machine Owner Key).
    *Based on general kernel signing procedures for [Fedora](https://docs.fedoraproject.org/en-US/quick-docs/kernel-build-custom/) and [RHEL](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/managing_monitoring_and_updating_the_kernel/signing-a-kernel-and-modules-for-secure-boot_managing-monitoring-and-updating-the-kernel#generating-a-public-and-private-key-pair_signing-a-kernel-and-modules-for-secure-boot).*

    ```bash
    # Install required packages
    sudo dnf install pesign openssl kernel-devel mokutil keyutils

    # Allow our user to sign kernels
    sudo echo "$USER" | sudo tee -a /etc/pesign/users
    sudo /usr/libexec/pesign/pesign-authorize

    # Generate a certificate to sign the kernel with
    openssl req -new -x509 -newkey rsa:2048 -keyout "key.pem" \
    -outform DER -out "cert.der" -nodes -days 36500 \
    -subj "/CN=CachyOS Secure Boot/"
    openssl pkcs12 -export -out key.p12 -inkey key.pem -in cert.der
    sudo certutil -A -i cert.der -n "CachyOS Secure Boot" -d /etc/pki/pesign/ -t "Pu,Pu,Pu"

    # Import the certificate
    sudo pk12util -i key.p12 -d /etc/pki/pesign
    sudo mokutil --import "cert.der"

    # Sign the kernel, replace "vmlinuz-6.14.6-cachyos1.fc42.x86_64" with the current version.
    cd /boot
    sudo pesign --certificate 'CachyOS Secure Boot' \
    --in vmlinuz-6.14.6-cachyos1.fc42.x86_64 \
    --sign \
    --out vmlinuz-6.14.6-cachyos1.fc42.x86_64.signed

    # Manually replace the unsigned kernel with the signed one (pesign can't overwrite files right now).
    sudo mv vmlinuz-6.14.6-cachyos1.fc42.x86_64.signed vmlinuz-6.14.6-cachyos1.fc42.x86_64
    ```

  4. mikaeldui revised this gist Aug 4, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -79,7 +79,7 @@ echo "Signing $KERNEL_IMAGE..."
    pesign --certificate "$MOK_KEY_NICKNAME" --in "$KERNEL_IMAGE" --sign --out "$KERNEL_IMAGE.signed"
    mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"
    ```
    3. Correct the permissions with: `sudo chown root:root /etc/kernel/postinst.d/00-signing ; chmod u+rx /etc/kernel/postinst.d/00-signing`
    3. Correct the permissions with: `sudo chown root:root /etc/kernel/postinst.d/00-signing ; sudo chmod u+rx /etc/kernel/postinst.d/00-signing`

    ## Fix default kernel after updates

  5. mikaeldui revised this gist Aug 4, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -25,7 +25,7 @@ We can self-sign the kernel by adding our key as a MOK (Machine Owner Key).

    ```bash
    sudo dnf install pesign openssl kernel-devel mokutil keyutils
    sudo echo "$USER" >> /etc/pesign/users
    sudo echo "$USER" | sudo tee -a /etc/pesign/users
    sudo /usr/libexec/pesign/pesign-authorize
    openssl req -new -x509 -newkey rsa:2048 -keyout "key.pem" \
    -outform DER -out "cert.der" -nodes -days 36500 \
  6. mikaeldui revised this gist May 30, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -92,6 +92,6 @@ Whenever you receive an update to the official Fedora kernel it will replace the

    set -e

    grubby --set-default=/boot/$(ls /boot | grep vmlinuz.*cachyos | sort -V | tail -1)
    grubby --set-default=/boot/$(ls /boot | grep vmlinuz.*cachy | sort -V | tail -1)
    ```
    3. Correct the permissions with: `sudo chown root:root /etc/kernel/postinst.d/99-default ; sudo chmod u+rx /etc/kernel/postinst.d/99-default`
  7. mikaeldui revised this gist May 26, 2025. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -76,8 +76,8 @@ fi

    echo "Signing $KERNEL_IMAGE..."

    sudo pesign --certificate "$MOK_KEY_NICKNAME" --in "$KERNEL_IMAGE" --sign --out "$KERNEL_IMAGE.signed"
    sudo mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"
    pesign --certificate "$MOK_KEY_NICKNAME" --in "$KERNEL_IMAGE" --sign --out "$KERNEL_IMAGE.signed"
    mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"
    ```
    3. Correct the permissions with: `sudo chown root:root /etc/kernel/postinst.d/00-signing ; chmod u+rx /etc/kernel/postinst.d/00-signing`

  8. mikaeldui revised this gist May 21, 2025. 1 changed file with 8 additions and 8 deletions.
    16 changes: 8 additions & 8 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -8,15 +8,15 @@ First, make sure you have Secure Boot with `mokutil --sb-state`.
    *Note, there's a second way of doing this by using [`sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/), but I didn't want to wipe my Secure Boot keys.*

    # Installing the CachyOS Kernel
    Instructions at https://github.com/CachyOS/copr-linux-cachyos
    Full instructions at https://github.com/CachyOS/copr-linux-cachyos

    1. Check your CPU support `/lib64/ld-linux-x86-64.so.2 --help | grep "(supported, searched)"`, my CPU supports v2, v3 and v4.
    2. Enable a suitable repo: `sudo dnf copr enable bieszczaders/kernel-cachyos`.
    3. Install suitable kernel: `sudo dnf install kernel-cachyos kernel-cachyos-devel-matched`.
    4. Let the kernel load modules: `sudo setsebool -P domain_kernel_load_modules on`.
    5. Done!

    If you reboot now you'll get the "bad shim signature" error and have to pick an official Fedora kernel to boot, don't worry.
    If you reboot now you'll get the "bad shim signature" error and have to pick an official Fedora kernel to boot. Don't worry, you didn't break anything.

    # Signing the CachyOS Kernel
    We can self-sign the kernel by adding our key as a MOK (Machine Owner Key).
    @@ -29,21 +29,21 @@ sudo echo "$USER" >> /etc/pesign/users
    sudo /usr/libexec/pesign/pesign-authorize
    openssl req -new -x509 -newkey rsa:2048 -keyout "key.pem" \
    -outform DER -out "cert.der" -nodes -days 36500 \
    -subj "/CN=mikaeldui Secure Boot/"
    -subj "/CN=CachyOS Secure Boot/"
    openssl pkcs12 -export -out key.p12 -inkey key.pem -in cert.der
    sudo certutil -A -i cert.der -n "mikaeldui Secure Boot" -d /etc/pki/pesign/ -t "Pu,Pu,Pu"
    sudo certutil -A -i cert.der -n "CachyOS Secure Boot" -d /etc/pki/pesign/ -t "Pu,Pu,Pu"
    sudo pk12util -i key.p12 -d /etc/pki/pesign
    sudo mokutil --import "cert.der"
    cd /boot
    sudo pesign --certificate 'mikaeldui Secure Boot' \
    sudo pesign --certificate 'CachyOS Secure Boot' \
    --in vmlinuz-6.14.6-cachyos1.fc42.x86_64 \
    --sign \
    --out vmlinuz-6.14.6-cachyos1.fc42.x86_64.signed
    sudo mv vmlinuz-6.14.6-cachyos1.fc42.x86_64.signed vmlinuz-6.14.6-cachyos1.fc42.x86_64
    ```

    And reboot and choose enroll the key. The MOK password is only used once so I suggest using "12345678".
    Replace "mikaeldui Secure Boot" and "vmlinuz-6.14.6-cachyos1.fc42.x86_64" with whatever applies in your case.
    Replace "CachyOS Secure Boot" and "vmlinuz-6.14.6-cachyos1.fc42.x86_64" with whatever applies in your case.

    # Automatically signing kernel updates

    @@ -57,7 +57,7 @@ Whooray! You can now boot the CachyOS Kernel for Fedora with Secure Boot enabled
    set -e

    KERNEL_IMAGE="$2"
    MOK_KEY_NICKNAME="mikaeldui Secure Boot"
    MOK_KEY_NICKNAME="CachyOS Secure Boot"

    if [ "$#" -ne "2" ] ; then
    echo "Wrong count of command line arguments. This is not meant to be called directly." >&2
    @@ -79,7 +79,7 @@ echo "Signing $KERNEL_IMAGE..."
    sudo pesign --certificate "$MOK_KEY_NICKNAME" --in "$KERNEL_IMAGE" --sign --out "$KERNEL_IMAGE.signed"
    sudo mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"
    ```
    3. Correct the permissions with: `chown root:root /etc/kernel/postinst.d/00-signing ; chmod u+rx /etc/kernel/postinst.d/00-signing`
    3. Correct the permissions with: `sudo chown root:root /etc/kernel/postinst.d/00-signing ; chmod u+rx /etc/kernel/postinst.d/00-signing`

    ## Fix default kernel after updates

  9. mikaeldui revised this gist May 21, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -83,7 +83,7 @@ sudo mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"

    ## Fix default kernel after updates

    Whenever you receive an update to the official Fedora kernel it will replace the CachyOS kernel as default. One solution is to uninstall the official kernel, and another is to reset the default kernel to CachyOS after each update:
    Whenever you receive an update to the official Fedora kernel it will replace the CachyOS kernel as the default kernel. One solution is to uninstall the official kernel, and another is to reset the default kernel to CachyOS after each update:

    1. Create and open `sudo nano /etc/kernel/postinst.d/99-default`
    2. Enter the following content:
  10. mikaeldui revised this gist May 20, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -5,7 +5,7 @@ Did you just install `kernel-cachyos` and got hit by `bad shim signature` when b

    First, make sure you have Secure Boot with `mokutil --sb-state`.

    *Note, there's a second way of doing this by using [`sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/), but I didnt want to wipe my Secure Boot keys.*
    *Note, there's a second way of doing this by using [`sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/), but I didn't want to wipe my Secure Boot keys.*

    # Installing the CachyOS Kernel
    Instructions at https://github.com/CachyOS/copr-linux-cachyos
  11. mikaeldui revised this gist May 20, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -5,7 +5,7 @@ Did you just install `kernel-cachyos` and got hit by `bad shim signature` when b

    First, make sure you have Secure Boot with `mokutil --sb-state`.

    *Note, there's a second way of doing this with [`sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/), but I didnt want to wipe my Secure Boot keys.*
    *Note, there's a second way of doing this by using [`sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/), but I didnt want to wipe my Secure Boot keys.*

    # Installing the CachyOS Kernel
    Instructions at https://github.com/CachyOS/copr-linux-cachyos
  12. mikaeldui revised this gist May 20, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -5,7 +5,7 @@ Did you just install `kernel-cachyos` and got hit by `bad shim signature` when b

    First, make sure you have Secure Boot with `mokutil --sb-state`.

    *Note, theres a second way of doing this with [`sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/), but I didnt want to wipe my Secure Boot keys.*
    *Note, there's a second way of doing this with [`sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/), but I didnt want to wipe my Secure Boot keys.*

    # Installing the CachyOS Kernel
    Instructions at https://github.com/CachyOS/copr-linux-cachyos
  13. mikaeldui revised this gist May 20, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -83,7 +83,7 @@ sudo mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"

    ## Fix default kernel after updates

    Whenever you receive an update to the official Fedora kernel it will replace the CachyOS kernel as default. One solution is to uninstall the official kernel and another could be to reset the default kernel to CachyOS after each update:
    Whenever you receive an update to the official Fedora kernel it will replace the CachyOS kernel as default. One solution is to uninstall the official kernel, and another is to reset the default kernel to CachyOS after each update:

    1. Create and open `sudo nano /etc/kernel/postinst.d/99-default`
    2. Enter the following content:
  14. mikaeldui revised this gist May 20, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -83,7 +83,7 @@ sudo mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"

    ## Fix default kernel after updates

    Whenever you receive an update to the official Fedora kernel it will replace the CachyOS kernel as default. One solution is to uninstall the official kernel and another could be to reset the default kernel to CachyOS on each update.
    Whenever you receive an update to the official Fedora kernel it will replace the CachyOS kernel as default. One solution is to uninstall the official kernel and another could be to reset the default kernel to CachyOS after each update:

    1. Create and open `sudo nano /etc/kernel/postinst.d/99-default`
    2. Enter the following content:
  15. mikaeldui revised this gist May 20, 2025. 1 changed file with 0 additions and 2 deletions.
    2 changes: 0 additions & 2 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -46,7 +46,6 @@ And reboot and choose enroll the key. The MOK password is only used once so I su
    Replace "mikaeldui Secure Boot" and "vmlinuz-6.14.6-cachyos1.fc42.x86_64" with whatever applies in your case.

    # Automatically signing kernel updates
    Experimental: I haven't tested this yet, so I dont know if it works.

    Whooray! You can now boot the CachyOS Kernel for Fedora with Secure Boot enabled! Let's make sure that it continues to work across updates!

    @@ -83,7 +82,6 @@ sudo mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"
    3. Correct the permissions with: `chown root:root /etc/kernel/postinst.d/00-signing ; chmod u+rx /etc/kernel/postinst.d/00-signing`

    ## Fix default kernel after updates
    Experimental!

    Whenever you receive an update to the official Fedora kernel it will replace the CachyOS kernel as default. One solution is to uninstall the official kernel and another could be to reset the default kernel to CachyOS on each update.

  16. mikaeldui revised this gist May 20, 2025. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -21,6 +21,8 @@ If you reboot now you'll get the "bad shim signature" error and have to pick an
    # Signing the CachyOS Kernel
    We can self-sign the kernel by adding our key as a MOK (Machine Owner Key).

    *Based on general kernel signing procedures for [Fedora](https://docs.fedoraproject.org/en-US/quick-docs/kernel-build-custom/) and [RHEL](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/managing_monitoring_and_updating_the_kernel/signing-a-kernel-and-modules-for-secure-boot_managing-monitoring-and-updating-the-kernel#generating-a-public-and-private-key-pair_signing-a-kernel-and-modules-for-secure-boot).*

    ```bash
    sudo dnf install pesign openssl kernel-devel mokutil keyutils
    sudo echo "$USER" >> /etc/pesign/users
  17. mikaeldui revised this gist May 16, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -5,7 +5,7 @@ Did you just install `kernel-cachyos` and got hit by `bad shim signature` when b

    First, make sure you have Secure Boot with `mokutil --sb-state`.

    *This guide shows an altenative method using `pesign` and `mokutil`. The [recommended `sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/) wasn't compatible with my setup.*
    *Note, theres a second way of doing this with [`sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/), but I didnt want to wipe my Secure Boot keys.*

    # Installing the CachyOS Kernel
    Instructions at https://github.com/CachyOS/copr-linux-cachyos
  18. mikaeldui revised this gist May 16, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -92,6 +92,6 @@ Whenever you receive an update to the official Fedora kernel it will replace the

    set -e

    grubby --set-default=/boot/$(ls /boot | grep vmlinuz.*cachyos | tail -1)
    grubby --set-default=/boot/$(ls /boot | grep vmlinuz.*cachyos | sort -V | tail -1)
    ```
    3. Correct the permissions with: `sudo chown root:root /etc/kernel/postinst.d/99-default ; sudo chmod u+rx /etc/kernel/postinst.d/99-default`
  19. mikaeldui revised this gist May 16, 2025. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -43,7 +43,7 @@ sudo mv vmlinuz-6.14.6-cachyos1.fc42.x86_64.signed vmlinuz-6.14.6-cachyos1.fc42.
    And reboot and choose enroll the key. The MOK password is only used once so I suggest using "12345678".
    Replace "mikaeldui Secure Boot" and "vmlinuz-6.14.6-cachyos1.fc42.x86_64" with whatever applies in your case.

    # Signing kernel updates
    # Automatically signing kernel updates
    Experimental: I haven't tested this yet, so I dont know if it works.

    Whooray! You can now boot the CachyOS Kernel for Fedora with Secure Boot enabled! Let's make sure that it continues to work across updates!
    @@ -80,7 +80,7 @@ sudo mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"
    ```
    3. Correct the permissions with: `chown root:root /etc/kernel/postinst.d/00-signing ; chmod u+rx /etc/kernel/postinst.d/00-signing`

    ## Default kernel after updates
    ## Fix default kernel after updates
    Experimental!

    Whenever you receive an update to the official Fedora kernel it will replace the CachyOS kernel as default. One solution is to uninstall the official kernel and another could be to reset the default kernel to CachyOS on each update.
  20. mikaeldui revised this gist May 16, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -92,6 +92,6 @@ Whenever you receive an update to the official Fedora kernel it will replace the

    set -e

    grubby --set-default=/boot/$(ls /boot | grep vmlinuz.*cachyos)
    grubby --set-default=/boot/$(ls /boot | grep vmlinuz.*cachyos | tail -1)
    ```
    3. Correct the permissions with: `sudo chown root:root /etc/kernel/postinst.d/99-default ; sudo chmod u+rx /etc/kernel/postinst.d/99-default`
  21. mikaeldui revised this gist May 16, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -94,4 +94,4 @@ set -e

    grubby --set-default=/boot/$(ls /boot | grep vmlinuz.*cachyos)
    ```
    3. Correct the permissions with: `chown root:root /etc/kernel/postinst.d/99-default ; chmod u+rx /etc/kernel/postinst.d/99-default`
    3. Correct the permissions with: `sudo chown root:root /etc/kernel/postinst.d/99-default ; sudo chmod u+rx /etc/kernel/postinst.d/99-default`
  22. mikaeldui revised this gist May 16, 2025. 1 changed file with 16 additions and 0 deletions.
    16 changes: 16 additions & 0 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -79,3 +79,19 @@ sudo pesign --certificate "$MOK_KEY_NICKNAME" --in "$KERNEL_IMAGE" --sign --out
    sudo mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"
    ```
    3. Correct the permissions with: `chown root:root /etc/kernel/postinst.d/00-signing ; chmod u+rx /etc/kernel/postinst.d/00-signing`

    ## Default kernel after updates
    Experimental!

    Whenever you receive an update to the official Fedora kernel it will replace the CachyOS kernel as default. One solution is to uninstall the official kernel and another could be to reset the default kernel to CachyOS on each update.

    1. Create and open `sudo nano /etc/kernel/postinst.d/99-default`
    2. Enter the following content:
    ```bash
    #!/bin/sh

    set -e

    grubby --set-default=/boot/$(ls /boot | grep vmlinuz.*cachyos)
    ```
    3. Correct the permissions with: `chown root:root /etc/kernel/postinst.d/99-default ; chmod u+rx /etc/kernel/postinst.d/99-default`
  23. mikaeldui revised this gist May 16, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -46,7 +46,7 @@ Replace "mikaeldui Secure Boot" and "vmlinuz-6.14.6-cachyos1.fc42.x86_64" with w
    # Signing kernel updates
    Experimental: I haven't tested this yet, so I dont know if it works.

    Whooray! You can now boot the CachyOS Kernel for Fedora with Secure Boot enabled! Lets make sure that it continues to work across updates!
    Whooray! You can now boot the CachyOS Kernel for Fedora with Secure Boot enabled! Let's make sure that it continues to work across updates!

    1. Create and open `sudo nano /etc/kernel/postinst.d/00-signing`
    2. Enter the following content:
  24. mikaeldui revised this gist May 16, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -5,7 +5,7 @@ Did you just install `kernel-cachyos` and got hit by `bad shim signature` when b

    First, make sure you have Secure Boot with `mokutil --sb-state`.

    *This guide shows an altenative method using `pesign` and `mokutil`. The [recommended `sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/) wasnt compatible with my setup.*
    *This guide shows an altenative method using `pesign` and `mokutil`. The [recommended `sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/) wasn't compatible with my setup.*

    # Installing the CachyOS Kernel
    Instructions at https://github.com/CachyOS/copr-linux-cachyos
  25. mikaeldui revised this gist May 16, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -10,7 +10,7 @@ First, make sure you have Secure Boot with `mokutil --sb-state`.
    # Installing the CachyOS Kernel
    Instructions at https://github.com/CachyOS/copr-linux-cachyos

    1. Check your CPU support `/lib64/ld-linux-x86-64.so.2 --help | grep "(supported, searched)"`, my cpu supports v2, v3 and v4.
    1. Check your CPU support `/lib64/ld-linux-x86-64.so.2 --help | grep "(supported, searched)"`, my CPU supports v2, v3 and v4.
    2. Enable a suitable repo: `sudo dnf copr enable bieszczaders/kernel-cachyos`.
    3. Install suitable kernel: `sudo dnf install kernel-cachyos kernel-cachyos-devel-matched`.
    4. Let the kernel load modules: `sudo setsebool -P domain_kernel_load_modules on`.
  26. mikaeldui revised this gist May 16, 2025. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,12 +1,12 @@
    ![image](https://gist.github.com/user-attachments/assets/b241ca59-fc62-4d67-8251-0bf8560d3b0d)

    # CachyOS Kernel for Fedora with Secure Boot
    This guide shows an altenative method using `pesign` and `mokutil`. The recommended `sbctl` wasnt compatible with my setup.

    Did you just install `kernel-cachyos` and got hit by `bad shim signature` when booting? Me too. This is how I fixed it.

    First, make sure you have Secure Boot with `mokutil --sb-state`.

    *This guide shows an altenative method using `pesign` and `mokutil`. The [recommended `sbctl`](https://wiki.cachyos.org/configuration/secure_boot_setup/) wasnt compatible with my setup.*

    # Installing the CachyOS Kernel
    Instructions at https://github.com/CachyOS/copr-linux-cachyos

  27. mikaeldui revised this gist May 16, 2025. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,8 @@
    ![image](https://gist.github.com/user-attachments/assets/b241ca59-fc62-4d67-8251-0bf8560d3b0d)

    # CachyOS Kernel for Fedora with Secure Boot
    This guide shows an altenative method using `pesign` and `mokutil`. The recommended `sbctl` wasnt compatible with my setup.

    Did you just install `kernel-cachyos` and got hit by `bad shim signature` when booting? Me too. This is how I fixed it.

    First, make sure you have Secure Boot with `mokutil --sb-state`.
  28. mikaeldui revised this gist May 16, 2025. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,5 @@
    ![image](https://gist.github.com/user-attachments/assets/b241ca59-fc62-4d67-8251-0bf8560d3b0d)

    # CachyOS Kernel for Fedora with Secure Boot
    Did you just install `kernel-cachyos` and got hit by `bad shim signature` when booting? Me too. This is how I fixed it.

  29. mikaeldui revised this gist May 16, 2025. 1 changed file with 0 additions and 1 deletion.
    1 change: 0 additions & 1 deletion CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -29,7 +29,6 @@ sudo certutil -A -i cert.der -n "mikaeldui Secure Boot" -d /etc/pki/pesign/ -t "
    sudo pk12util -i key.p12 -d /etc/pki/pesign
    sudo mokutil --import "cert.der"
    cd /boot
    sudo dnf reinstall kernel-cachyos-core
    sudo pesign --certificate 'mikaeldui Secure Boot' \
    --in vmlinuz-6.14.6-cachyos1.fc42.x86_64 \
    --sign \
  30. mikaeldui created this gist May 16, 2025.
    78 changes: 78 additions & 0 deletions CachyOS Kernel for Fedora with Secure Boot.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,78 @@
    # CachyOS Kernel for Fedora with Secure Boot
    Did you just install `kernel-cachyos` and got hit by `bad shim signature` when booting? Me too. This is how I fixed it.

    First, make sure you have Secure Boot with `mokutil --sb-state`.

    # Installing the CachyOS Kernel
    Instructions at https://github.com/CachyOS/copr-linux-cachyos

    1. Check your CPU support `/lib64/ld-linux-x86-64.so.2 --help | grep "(supported, searched)"`, my cpu supports v2, v3 and v4.
    2. Enable a suitable repo: `sudo dnf copr enable bieszczaders/kernel-cachyos`.
    3. Install suitable kernel: `sudo dnf install kernel-cachyos kernel-cachyos-devel-matched`.
    4. Let the kernel load modules: `sudo setsebool -P domain_kernel_load_modules on`.
    5. Done!

    If you reboot now you'll get the "bad shim signature" error and have to pick an official Fedora kernel to boot, don't worry.

    # Signing the CachyOS Kernel
    We can self-sign the kernel by adding our key as a MOK (Machine Owner Key).

    ```bash
    sudo dnf install pesign openssl kernel-devel mokutil keyutils
    sudo echo "$USER" >> /etc/pesign/users
    sudo /usr/libexec/pesign/pesign-authorize
    openssl req -new -x509 -newkey rsa:2048 -keyout "key.pem" \
    -outform DER -out "cert.der" -nodes -days 36500 \
    -subj "/CN=mikaeldui Secure Boot/"
    openssl pkcs12 -export -out key.p12 -inkey key.pem -in cert.der
    sudo certutil -A -i cert.der -n "mikaeldui Secure Boot" -d /etc/pki/pesign/ -t "Pu,Pu,Pu"
    sudo pk12util -i key.p12 -d /etc/pki/pesign
    sudo mokutil --import "cert.der"
    cd /boot
    sudo dnf reinstall kernel-cachyos-core
    sudo pesign --certificate 'mikaeldui Secure Boot' \
    --in vmlinuz-6.14.6-cachyos1.fc42.x86_64 \
    --sign \
    --out vmlinuz-6.14.6-cachyos1.fc42.x86_64.signed
    sudo mv vmlinuz-6.14.6-cachyos1.fc42.x86_64.signed vmlinuz-6.14.6-cachyos1.fc42.x86_64
    ```

    And reboot and choose enroll the key. The MOK password is only used once so I suggest using "12345678".
    Replace "mikaeldui Secure Boot" and "vmlinuz-6.14.6-cachyos1.fc42.x86_64" with whatever applies in your case.

    # Signing kernel updates
    Experimental: I haven't tested this yet, so I dont know if it works.

    Whooray! You can now boot the CachyOS Kernel for Fedora with Secure Boot enabled! Lets make sure that it continues to work across updates!

    1. Create and open `sudo nano /etc/kernel/postinst.d/00-signing`
    2. Enter the following content:
    ```bash
    #!/bin/sh

    set -e

    KERNEL_IMAGE="$2"
    MOK_KEY_NICKNAME="mikaeldui Secure Boot"

    if [ "$#" -ne "2" ] ; then
    echo "Wrong count of command line arguments. This is not meant to be called directly." >&2
    exit 1
    fi

    if [ ! -x "$(command -v pesign)" ] ; then
    echo "pesign not executable. Bailing." >&2
    exit 1
    fi

    if [ ! -w "$KERNEL_IMAGE" ] ; then
    echo "Kernel image $KERNEL_IMAGE is not writable." >&2
    exit 1
    fi

    echo "Signing $KERNEL_IMAGE..."

    sudo pesign --certificate "$MOK_KEY_NICKNAME" --in "$KERNEL_IMAGE" --sign --out "$KERNEL_IMAGE.signed"
    sudo mv "$KERNEL_IMAGE.signed" "$KERNEL_IMAGE"
    ```
    3. Correct the permissions with: `chown root:root /etc/kernel/postinst.d/00-signing ; chmod u+rx /etc/kernel/postinst.d/00-signing`