1- # Ubuntu Secure Boot Setup
1+ # Setup Sprout for Ubuntu with Secure Boot
22
3- ## Generate and Install Secure Boot Key
3+ ## Prerequisites
4+
5+ - Modern Ubuntu release: tested on Ubuntu 25.10 on ARM64
6+ - EFI System Partition mounted on ` /boot/efi ` (the default)
7+ - ext4 or FAT32/exFAT formatted ` /boot ` partition
8+
9+ ## Step 1: Generate and Install Secure Boot Key
410
511``` bash
612# Create a directory to store the Secure Boot MOK key and certificates.
@@ -28,7 +34,7 @@ $ mokutil --import mok.cer
2834# Select "Reboot" to boot back into your Operating System.
2935```
3036
31- ## Prepare Secure Boot Environment
37+ ## Step 2: Prepare the Secure Boot Environment
3238
3339``` bash
3440# Create a directory for Sprout EFI artifacts.
@@ -45,13 +51,13 @@ $ cp /usr/lib/shim/mmaa64.efi /boot/efi/EFI/sprout/mmaa64.efi
4551$ cp /usr/lib/shim/fbaa64.efi /boot/efi/EFI/sprout/fbaa64.efi
4652```
4753
48- ## Install Unsigned Sprout
54+ ## Step 3: Install Unsigned Sprout
4955
5056Download the latest sprout.efi release from the [ GitHub releases page] ( https://github.com/edera-dev/sprout/releases ) .
5157For x86_64 systems, download the ` sprout-x86_64.efi ` file, and for ARM64 systems, download the ` sprout-aarch64.efi ` file.
5258Copy the downloaded ` sprout.efi ` file to ` /boot/efi/EFI/sprout/sprout.unsigned.efi ` on your EFI System Partition.
5359
54- ## Sign Sprout for Secure Boot
60+ ## Step 4: Sign Sprout for Secure Boot
5561
5662``` bash
5763# For x86_64, sign the unsigned Sprout artifact and name it grubaa64.efi which is what the shim will call.
@@ -69,7 +75,14 @@ $ sbsign \
6975 /boot/efi/EFI/sprout/sprout.unsigned.efi
7076```
7177
72- ## Sign EFI Drivers
78+ ## Step 5: Install and Sign EFI Drivers
79+
80+ You will need a filesystem EFI driver if ` /boot ` is not FAT32 or ExFAT.
81+ If ` /boot ` is FAT32 or ExFAT, you can skip this step.
82+
83+ Most Ubuntu systems use an ext4 filesystem for ` /boot ` .
84+ You can download an EFI filesystem driver from [ EfiFs releases] ( https://github.com/pbatard/EfiFs/releases ) .
85+ For ext4, download the ` ext2 ` file for your platform. It will work for ext4 filesystems too.
7386
7487If you have an EFI driver, copy the driver to ` /boot/efi/EFI/sprout/DRIVER_NAME.unsigned.efi ` for signing.
7588
@@ -86,7 +99,7 @@ $ sbsign \
8699 /boot/efi/EFI/sprout/ext4.unsigned.efi
87100```
88101
89- ## Create Sprout Configuration
102+ ## Step 6: Create Sprout Configuration
90103
91104Write the following to the file ` /boot/efi/sprout.toml ` :
92105
@@ -100,6 +113,8 @@ version = 1
100113linux-options = " root=UUID=MY_ROOT_UUID"
101114
102115# load an ext4 EFI driver.
116+ # skip this if you do not have an filesystem driver.
117+ # if your filesystem driver is not named ext4, change accordingly.
103118[drivers .ext4 ]
104119path = " \\ EFI\\ sprout\\ ext4.efi"
105120
@@ -113,14 +128,17 @@ autoconfigure = true
113128Ensure you add the signed driver paths to the configuration, not the unsigned ones.
114129If you do not have any drivers, exclude the drivers section entirely.
115130
116- ## Configure Sprout Boot Entry
131+ ## Step 7: Configure Sprout Boot Entry
117132
118- ``` bash
119- # In the following commands, replace /dev/ESP_PARTITION with the actual path to the ESP partition block device.
133+ In the following commands, replace /dev/ESP_PARTITION with the actual path to the ESP partition block device.
120134
135+ ``` bash
121136# For x86_64, run this command to add Sprout as the default boot entry.
122137$ efibootmgr -d /dev/ESP_PARTITION -c -L ' Sprout' -l ' \EFI\sprout\shimx64.efi'
123138
124139# For aarch64, run this command to add Sprout as the default boot entry.
125140$ efibootmgr -d /dev/ESP_PARTITION -c -L ' Sprout' -l ' \EFI\sprout\shimaa64.efi'
126141```
142+
143+ Reboot your machine and it should boot into Sprout.
144+ If Sprout fails to boot, it should boot into the original bootloader.
0 commit comments