My motherboard currently boots Windows 10, and its UEFI firmware does not appear to allow Secure Boot to be disabled. I also tried clearing the Secure Boot keys, but that did not help, and I do not want to risk damaging the motherboard by changing firmware settings blindly. I understand that Arch does not provide an official Secure Boot-ready installation image, but I would like to install it while keeping Secure Boot enabled. The Arch documentation mentions editing the EFI system partition on the installation USB to add Secure Boot support. Could someone explain clearly which EFI partition needs to be edited and outline a safe installation and signing process?
5 Answers
Disabling Secure Boot through the firmware settings normally does not brick a motherboard, but firmware menus can use confusing names and behave differently between models. Since your system does not show an obvious option, check the manufacturer's documentation for the exact model rather than clearing keys or editing partitions experimentally. Also, Secure Boot is not identical to the disk's partition scheme: an EFI System Partition is a small FAT-formatted boot partition, while GPT is the partition-table format used by the drive.
The EFI system partition mentioned in that documentation is the partition on the Arch installation USB, not necessarily the EFI partition already used by Windows. You should avoid modifying the Windows boot partition just to make the installer boot. Arch can work with Secure Boot, but you generally need to create your own keys and sign the bootloader, kernel, and other relevant boot components. Before changing keys or EFI files, identify the exact motherboard or laptop model and check which Secure Boot modes it supports.
A common approach is to install Arch and use sbctl to create keys and sign the required boot files. You can also configure automatic signing when packages or the kernel are updated, so ongoing maintenance is mostly automatic. Follow the Arch Secure Boot documentation carefully and make sure you have a recovery path before replacing firmware keys.
The simplest route may be to boot another Linux live environment and use it as the host for the Arch installation. From there, install the Arch installation scripts and proceed with the normal setup, then configure Secure Boot before restarting. The documentation's USB-editing instructions are specifically for keeping Secure Boot enabled while modifying the installation medium; they are not necessarily required for installing Arch onto an internal drive.
Be careful with claims that another distribution is Arch-based just because it supports Secure Boot. For example, Bazzite is Fedora-based. The important point is that distributions differ in whether they ship a trusted signed boot chain; with Arch, you usually need to establish and maintain that trust chain yourself.
I found references saying Secure Boot support was added and later removed from Arch's installation process, which is why I was unsure whether the installer itself still needed to be modified.