Secure Boot Setup on CachyOS (Limine)

This guide documents the complete process of enabling Secure Boot on CachyOS (Arch-based) using Limine and sbctl, including recovery from common Secure Boot mistakes and the Limine Blake2b hash mismatch panic.

Requirements

UEFI mode enabled (CSM disabled)
Limine as the bootloader
EFI System Partition mounted at /boot
Root access
sbctl installed

1. Install Required Packages

sudo pacman -S sbctl efibootmgr mokutil

mokutil is optional but useful for checking Secure Boot state.

2. Check Current Secure Boot Status

sudo sbctl status

If keys have not yet been enrolled, you’ll typically see:

Setup Mode: Enabled
Secure Boot: Disabled

3. Create Secure Boot Keys

sudo sbctl create-keys

4. Enroll Keys

For dual-boot systems:

sudo sbctl enroll-keys --microsoft

Linux-only systems:

sudo sbctl enroll-keys

This installs your Platform Key (PK), Key Exchange Keys (KEK), and signature database (db). The --microsoft option preserves Microsoft’s certificates so Windows can continue to boot.

5. Enable Secure Boot

Reboot into the firmware setup and:

Enable Secure Boot
Disable CSM/Legacy mode
Ensure the platform is no longer in Setup Mode

6. Sign Limine and Kernels

sudo sbctl sign -s /boot/EFI/limine/limine_x64.efi
sudo sbctl sign -s /boot/EFI/BOOT/BOOTX64.EFI
sudo sbctl sign-all

Verify:

sudo sbctl verify

7. Rebuild initramfs

sudo mkinitcpio -P

If prompted:

Would you like to run 'limine-mkinitcpio' now? [Y/n]

Answer:

This regenerates Limine boot entries.

8. Synchronize Limine Snapshots

limine-snapper-sync

This updates:

/boot/limine.conf
snapshot entries
Blake2b hashes
signs limine_x64.efi if configured

9. Final Verification

sudo sbctl status
sudo sbctl verify

Expected:

Setup Mode: Disabled
Secure Boot: Enabled
Vendor Keys: microsoft

Live USB Recovery

Mount the system:

sudo mount -o subvol=@ /dev/<root-partition> /mnt
sudo mkdir -p /mnt/boot
sudo mount /dev/<efi-partition> /mnt/boot
sudo arch-chroot /mnt

Rebuild and regenerate:

mkinitcpio -P
limine-snapper-sync
sbctl verify

Exit:

exit
sync
reboot

Fix: Blake2b Hash Does Not Match

If Limine displays:

PANIC: Blake2b hash ... does not match

the kernel or initramfs has changed since the hashes in limine.conf were generated.

Fix:

mkinitcpio -P

Accept the prompt to run limine-mkinitcpio, then run:

limine-snapper-sync

This regenerates limine.conf with fresh hashes.

Common Issues

Vendor Keys: none

sudo sbctl enroll-keys --microsoft

Setup Mode: Enabled

Keys have not been enrolled.

Secure Boot: Disabled

Enable Secure Boot in firmware.

Restored Factory Keys

If Secure Boot stops working after restoring factory keys:

Disable Secure Boot.
Boot Linux.
Re-enroll your keys:
```
sudo sbctl enroll-keys --microsoft
```
Enable Secure Boot again.

Useful Commands

sudo sbctl status
sudo sbctl verify
sudo sbctl sign-all
sudo sbctl list-enrolled-keys
mkinitcpio -P
limine-snapper-sync
efibootmgr -v