diff options
| author | Craig Jennings <c@cjennings.net> | 2026-09-13 07:00:06 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-09-13 07:00:06 -0500 |
| commit | 3bab9f1ff287c61e85504ad5ab0c5a0d69bf0a61 (patch) | |
| tree | 51ce3214db7164ff309b8e3bfad6ab56600153e4 | |
| parent | 6ed8697ae38e30bd7990553d26ea6bb4ef4d3e46 (diff) | |
| download | archangel-3bab9f1ff287c61e85504ad5ab0c5a0d69bf0a61.tar.gz archangel-3bab9f1ff287c61e85504ad5ab0c5a0d69bf0a61.zip | |
docs: check Secure Boot before blaming a lost EFI boot entry
A firmware update can re-enable Secure Boot without clearing NVRAM. The firmware then rejects the unsigned ZFSBootMenu or GRUB loader as "no bootable drive" rather than a security violation, which looks like a missing boot entry. A Framework BIOS update did this to an installed machine this week. I put a check-Secure-Boot-first bullet at the top of the troubleshooting section, with shim's MOK screen on the Ventoy stick as the tell and the firmware fix.
| -rw-r--r-- | README.org | 9 |
1 files changed, 9 insertions, 0 deletions
@@ -494,6 +494,15 @@ The ISO includes DKMS-built ZFS modules. If modules fail to load: ** Boot Fails After Installation +- Check Secure Boot before assuming the boot entry is gone. A firmware update + can re-enable it silently, and the unsigned ZFSBootMenu or GRUB loader is + then rejected with "Default Boot Device Missing" / "no bootable drive" + rather than a security-violation message. If you boot the ISO through + Ventoy, the tell is shim's MOK screen. A plain USB write of the ISO will not + boot at all under Secure Boot. Fix: disable Enforce Secure Boot in firmware + setup (on a Framework laptop: F2, Security, Secure Boot) and save. No + ~efibootmgr~ changes are needed. + *** ZFS - Check ZFSBootMenu appears (if not, check EFI boot order with ~efibootmgr~) - Verify pool can import: boot ISO, ~zpool import -f zroot~ |