Fedora UKI setup (without grub2, systemd-boot)

999-efibootmgr.install

#!/bin/sh

set -xe

COMMAND="${1:?}"
KERNEL_VERSION="${2:?}"
# shellcheck disable=SC2034
ENTRY_DIR_ABS="$3"
KERNEL_IMAGE="$4"

ENTRY_TOKEN="$KERNEL_INSTALL_ENTRY_TOKEN"
BOOT_ROOT="$KERNEL_INSTALL_BOOT_ROOT"
EFI_ROOT="EFI/Linux"

UKI_DIR="$BOOT_ROOT/$EFI_ROOT"
UKI_NAME="$ENTRY_TOKEN-$KERNEL_VERSION.efi"
UKI_FILE="$UKI_DIR/$UKI_NAME"

[ "$KERNEL_INSTALL_LAYOUT" = "uki" ] || exit 0

die() {
        echo "ERR: $*"
        exit 1
}

do_add() {
        if efibootmgr | grep "${UKI_NAME}"; then
                return 0
        fi
        
        # Add your OWN disk and partition here.
        efibootmgr --create --disk /dev/nvme0n1 --part 1 --label "Fedora ${KERNEL_VERSION}" --loader "${EFI_ROOT}/${UKI_NAME}" --unicode
}

do_remove() {
        local num=`efibootmgr | grep "${UKI_NAME}" | awk '{print $1}' | sed -e 's|Boot||g' -e 's/\*//g'`
        if [ "${num}" != "" ]; then
                efibootmgr --delete-bootnum --bootnum "${num}"
        fi

        return 0
}

if [ "${KERNEL_VERSION}" = "" ]; then
        die "kernel version is not set"
fi

case "${COMMAND}" in
        add)
                if [ ! -f "${UKI_FILE}" ]; then
                        die "${UKI_FILE} does not exist"
                fi
                do_add
        ;;
        remove)
                do_remove
        ;;
        "")
                die "action is no set"
        ;;
        *)
                die "ERR: unknown action: $1"
        ;;
esac

exit 0;

install.conf

layout=uki

REAMDE.md

How-to boot fedora linux without grub2 and systemd-boot, using EFI only.

• Install sbctl
• Create and enroll keys
• Add kernel install config and hook
  • Copy install.conf to /etc/kernel
  • Copy 999-efibootmgr.install to /etc/kernel/install.d
  • Add x bit: chmod +x /etc/kernel/install.d/999-efibootmgr.install
• Configure dracut with your rootfs UUID and keys (from sbctl)
  • Copy uki.conf to /etc/dracut.conf.d
• Add additional modules to dracut, like bluetooth or tpm2 (optional)
• Remove grub2 (optional)
• Install a new kernel (even old one is fine). Do not re-install current kernel.

Verify keys and signature

# sbctl status
Installed:      ✓ sbctl is installed
Owner GUID:     6747b4ea-7d2f-4d4a-aaa5-2bb8d130271d
Setup Mode:     ✓ Disabled
Secure Boot:    ✓ Enabled
Vendor Keys:    none

# sbctl verify
Verifying file database and EFI images in /boot...
✓ /boot/EFI/linux/linux_6.10.4-cb1.0.fc40.x86_64.efi is signed

/boot directory listing

# tree /boot
/boot
├── EFI
│  ├── linux
│  │  └── linux_6.10.4-cb1.0.fc40.x86_64.efi
└── loader
   └── random-seed

uki.conf

kernel_cmdline="root=UUID=4bbb4510-557b-4e99-bfa2-af2b71f0d744 ro rd.luks.uuid=luks-0360dc58-f652-481f-9ad7-243143c9dedd rd.luks.options=0360dc58-f652-481f-9ad7-243143c9dedd=tpm2-device=auto selinux=0"

show_modules=yes
dracut_rescue_image=no

add_dracutmodules+=" bluetooth tpm2-tss "

uefi="yes"
early_microcode="yes"
compress="zstd"
uefi_secureboot_cert="/var/lib/sbctl/keys/db/db.pem"
uefi_secureboot_key="/var/lib/sbctl/keys/db/db.key"