I need help to enable secure boot on my Hp omen 17 ( option not listed in BIOS)

[Ognjen98]

To begin this question i want to address the fact that my hp omen laptop with lack of support on a driver page where it lists that it is meant only for windows 10 rather then newer rollups or win11 when searching for manual drivers to download. It has very simplified Uefi Bios, and i could not figure out how to get to the section so that i can re-enable secure boot (for similar models it was written to repeatidly press f10 button on a keyboard in order to access secure boot menu separately then bios. I've also heard there is option Secure boot in Setup mode in cases like mine where i would eed to edit it through console rathen then Bios in order to run Dual boot OS and retain Secure Boot feature on win11.

It seems rather on this updated version but very minimal bios on this rather capable gaming laptop (BIOS f.19-11/15/2022) that this process is rather automatic, since i had attempted to install linux first it may have been disabled in the process, or never enabled for that matter.. One more thing to note is that there is method on ArchBased linux to enroll the (microsoft) keys manually through terminal with tool called SBCTL (but i would like to hear the feedback for my particular device before proceeding so that i do not render both OS unbootable..)

This post is both for my own reference and for anyone with GRUB who is struggling to set up Secure Boot. Here is what I found to be the easiest method: Re-install GRUB to utilize Microsoft's CA certificates (as opposed to shim) -- replace 'esp' with your EFI system partition: sudo grub-install --target=x86_64-efi --efi-directory=esp --bootloader-id=GRUB --modules="tpm" --disable-shim-lock Regenerate your grub configuration: sudo grub-mkconfig -o /boot/grub/grub.cfg Install the sbctl tool: sudo pacman -S sbctl As a pre-requisite, in your UEFI settings, set your secure boot mode to setup mode. Upon re-booting, verify that you are in setup mode: sbctl status Create your custom secure boot keys: sudo sbctl create-keys Enroll your custom keys (note -m is required to include Microsoft's CA certificates) sudo sbctl enroll-keys -m Verify that your keys have successfully been enrolled: sbctl status Check which files need to be signed for secure boot to work: sudo sbctl verify Sign all unsigned files (below is what I needed to sign, adjust according to your needs): sudo sbctl sign -s /efi/EFI/GRUB/grubx64.efi You may get an error because of an issue with certain files being immutable. To make those files mutable, run the following command for each file then re-sign afterwards: sudo chattr -i /sys/firmware/efi/efivars/<filename> Verify that everything has been signed: sudo sbctl verify Finally, in your UEFI settings, enable secure boot, and reboot. Verify that secure boot is enabled: sbctl status Note that sbctl comes with a pacman hook for automatic signing, so you don't need to worry when you update your system.