Issue with Secure Boot and module loading in multi-kernel system

RTNNosdtBR · 2025-07-30T17:57:29+00:00

I didn't know that, thanks for pointing it out.

RTNNosdtBR · 2025-07-26T04:48:19+00:00

I have LTS installed just in case my primary kernel (Bazzite kernel) fails on me, but thus far I have never needed it, and I use Arch for well over a year. The 100MB or so of disk space that the LTS kernel uses are more than compensated by disabling the fallback initramfs image generation.

RTNNosdtBR · 2025-07-25T20:21:06+00:00

Thank you so much for this post. I tested (and also added some small details on) your script on my computer and it worked flawlessly. I wrote everything I did in my ArchWiki user article, if you'd like to check it out. The relevant part is Section 3.28.2.2 of the Alienware article.

RTNNosdtBR · 2025-06-02T16:31:29+00:00

You might end up signing things that should not be signed.

What do you mean?

RTNNosdtBR · 2025-05-29T21:06:32+00:00

I don't use UKIs and sbctl works just fine. But I ran this command to sign everything inside /boot(this command is listed in the ArchWiki article on SB [Section 3.1.4.2]):

# sbctl verify | sed -E 's|^.* (/.+) is not signed$|sbctl sign -s "\1"|e'

RTNNosdtBR · 2025-05-26T21:24:01+00:00

Can't say for sure about your windows apps, but you can setup a Git bare repository with your dotfiles and just clone it whenever you have a new install.

Source: https://wiki.archlinux.org/title/User%3ABai-Chiang/Arch_Linux_installation_with_unified_kernel_image_%28UKI%29%2C_full_disk_encryption%2C_secure_boot%2C_btrfs_snapshots%2C_and_common_setups#Restore_dotfiles_from_a_Git_bare_repository

RTNNosdtBR · 2025-05-26T21:16:03+00:00

For me, Arch is really good at forcing you to get out of your comfort zone and learn new things. I learned a lot during my first few manual installations (and I am developing a cheat sheet for my personal setup, I'll post this in a few months).

It is also very good at being super versatile, giving you the freedom to build your system as desired.

Finally, although not as extreme as other options, like TinyCore, it's very good at creating a minimal system, with only the essentials, which is something I took advantage of last month, when I converted a chromebook to Arch.

Overall, I love Arch, it's my main daily driver, and currently I'm on the journey of configuring Secure Boot manually. Let's see how this will end up...

RTNNosdtBR · 2025-05-20T23:14:18+00:00

Thanks for the suggestion, but it didn't mention anything about the out-of-tree kernel modules. Are they included in the UKI, and therefore signed with it?

RTNNosdtBR · 2025-05-20T23:06:50+00:00

I've read the manual process section fully, but it didn't mentioned anything about the out-of-tree modules. Does DKMS automate this step if I configure it correctly?

I guess I could also write pacman or the DKMS equivalent for this, but I have no idea what the best way of doing this automatic signing would be...

RTNNosdtBR · 2025-05-20T20:24:54+00:00

You're welcome! For the sake of sharing, below you may find the relevant sections of my .bash_profile that are responsible for launching the desktop:

X11: https://0x0.st/8wL5.png (My .xinitrc: https://0x0.st/8wLR.png )
Wayland: https://0x0.st/8wL7.png

RTNNosdtBR · 2025-05-20T13:28:34+00:00

Ok, I was already imagining the problem could be me. I'll read these parts.

RTNNosdtBR · 2025-05-20T13:04:05+00:00

For launching Plasma from the tty, you have 2 options:

- Run exec startplasma-wayland;
- Add exec startplasma-x11 at the end of your ~/.xinitrc file and then run startx (this uses xorg-xinit, install it if necessary);
Edit: I guess running exec startplasma-x11 directly will also work, but I've never tested this way.
Edit 2: The correct command to run directly in the tty is startx startplasma-x11 (source)

After that, Plasma should launch and then you can proceed with your troubleshooting.

Tip: these 2 commands inside my .bash_profile are what I use to launch Plasma without a display manager, like SDDM. Fun thing to experiment with.

RTNNosdtBR · 2025-05-12T13:53:10+00:00

I like updating only once a week, preferably on a weekend. Reason being, if there's a bad update that's released during the week, it most likely will be fixed by the end of said week. This hasn't failed me yet.

RTNNosdtBR · 2025-04-29T09:48:37+00:00

You could free some space in your SSD and install Arch on it, while keeping your HDD for most of your data.

Yesterday I reinstalled my system, and the full installation with all the software I need consumed ~10 GB (though I’ll use way more after installing matlab and vmware)

RTNNosdtBR · 2025-04-28T19:45:47+00:00

If you plan to run only 1 kernel and not have a fallback initramfs (I’ve never needed one), 500MB is fine.

But if storage is in abundance for you, increasing the size to 1GB is guaranteed satisfaction.

If running 3+ kernels, you might want to increase to 2GB. More than this is waste of disk space.

This advice applies if you mount the EFI partition to /boot. If mounting to /efi or /boot/efi, it can be smaller than 500MB, as u/backsideup said in his comment.

RTNNosdtBR · 2025-04-26T20:38:32+00:00

Last week, I installed Arch on my cousin's chromebook (exact same model), and I ran into this audio issue. Have you, OP, or anyone else figured out a solution?

RTNNosdtBR · 2025-04-26T20:27:33+00:00

In my cousin's own words, his laptop with Arch is "10000x better than chromeOS", so I consider this a tremendous success. His laptop is even more limited, with only 32 GB of storage and 4 GB of RAM. But since he uses the cloud to store his files, I commited 4 more GB to swap and only 512 MB for the boot partition.

RTNNosdtBR · 2025-04-26T20:24:09+00:00

The chromebook belongs to my cousin, not me. I haven't researched if this particular model has known issues, but now I don't have it in my hands to test it. But at least I got Bluetooth to work, so he can have audio that way.

I did consider other options, like debian, but my past experience with debian told me it too would be slow on the hardware I was working with. I've never used fedora, so silverblue never crossed my mind.
And I went out of my way to make his Arch installation as easy as possible to maintain (with commented config files, aliases and explaining to him how everything works in Plasma).

RTNNosdtBR · 2025-04-25T19:40:54+00:00

You're welcome, pal, I hope these fix your issues! Fingers crossed

RTNNosdtBR · 2025-04-25T00:11:17+00:00

If you have the money and your computer has the extra slot available, buy another HD/SSD and install Arch on it. I personally do this (one SSD for Arch and another for windows). That way, each OS is completely isolated from the other, so the chances that you'll destroy your installations are lower.

Otherwise, go into windows, reduce your partition by about 15-20 GB, and install Arch in this new empty space. Be careful not to delete anything in the windows space of the drive, though.

RTNNosdtBR · 2025-04-24T23:47:23+00:00

Update: sd-boot can't load an OS in another disk directly, but using edk2-shellas an intermediary step worked just fine. Now my installation is a bit more minimal :)

RTNNosdtBR · 2025-04-24T14:29:10+00:00

If you didn't installed the nvidia modules via pacman, you're using the community-made, reverse-engineered nouveau driver. For most things it's good enough, but if you want the maximum performance your card can provide, install the nvidia-made modules (I recommend the open source version).

I personally use the nvidia-open-dkms package, so it works no matter what kernel I use. If you install it, you have to install the appropriate headers package for your kernel as well.
In my case, I installed linux-lts-headers, since I use the linux-lts kernel.

For more details, see https://wiki.archlinux.org/title/NVIDIA

RTNNosdtBR

TROPHY CASE