[GLLUG] Help for a newbie. Installing Ubuntu

[Chris Vine]

On Tue, 24 May 2016 07:03:39 +0100
Christopher Hunter via GLLUG <gllug at mailman.lug.org.uk> wrote:
> On 24/05/16 06:21, James Courtier-Dutton via GLLUG wrote:
> >
> > Hi,
> >
> > From a quick google, it seems that you need a 32bit linux install
> > usb stick to boot. 64bit efi boot will not work. Only 32bit efi
> > boot will work
> >  
> 
> I can assure you that neither works!.  One of my colleagues managed
> to install "Puppy" by removing the drive from the computer
> altogether, writing to the drive directly using a USB to SATA adaptor
> and another computer, and directly writing to the BIOS to change some
> of the OS flags.  It took a whole day to get it (sort of) working -
> wi-fi and sound proved to be impossible - and he only carried on
> because of stubbornness - he wasn't going to be beaten by a cheap
> laptop!  The computer was returned for credit because it was "not fit
> for purpose".

I suspect that the computer to which you refer is secure boot only,
which is permitted by the UEFI specification, and also now permitted by
the Windows 10 boot specification (earlier versions of the windows boot
specification required the firmware to provide some means of turning
secure boot off).

You can boot up linux on a USB stick on a secure boot only computer fine
using either the linux foundation's PreLoader or fedora's shim, because
these are pre-signed by Microsoft's third party signing key.  You just
need a stick with an installation image which has been prepared in that
way (if ubuntu do not have one, they had better produce one soon).  The
only circumstances in which this would fail is if the computer does not
have Microsoft's third-party signing key installed in its database.
Were that to happen, you would be left with having to install your own
PK, KEK and db key pairs, which the firmware should allow you to do but
which would be a pain.

Here is an easy test.  Make a usb stick with a VFAT formatted gpt EFI
partition.  Get Fedora's 0.8-8 shim EFI binary (shim.efi) and install it
on it as /EFI/BOOT/BOOTX64.EFI.  Get its corresponding MokManager
EFI binary (MokManager.efi) and install it on the stick with the
name /EFI/BOOT/grubx64.efi. Boot the stick and you should be presented
with MokManager.  If so you are ready to roll.  Insert your own MOK key
and then you can boot any kernel image you have signed with it either
via shim or by having shim hand off to something like reEFInd.

I have a USB stick that I have prepared this way which will install
slackware-current on secure boot only computers.

Chris