Start here
Secure Boot
Every computer makes its own boot keys. At most one key screen, once, with the password boot.
What it is
Secure Boot is the firmware check that lets only signed code start your computer. WolOS signs its boot images with keys made on your computer, at install. No image carries a shared WolOS key, and no two computers share one.
Why
A vendor key that signs every copy of a system is one secret that, once leaked, unlocks every copy. A key per computer has no such single point. The price is that the computer signs its own updates, so its key lives on it, encrypted to the TPM chip when there is one.
How
The installer picks the simplest path your firmware allows (wol boot detect):
| Your firmware | What happens |
|---|---|
| In Setup Mode | This computer's keys are enrolled next to Microsoft's. No key screen. |
| Secure Boot on, or off with Microsoft's third-party certificate present (most PCs) | A signed, unmodified first stage starts WolOS's loader. You confirm the key once, on a blue screen at the first start. |
| Neither | WolOS starts without signatures and Settings says so. |
| Secure Boot on and nothing above fits | A firmware setting has to change first; the installer says which. |
The key screen, step by step
After the restart a blue screen appears. It comes from your computer's firmware, not from WolOS, and it waits for you.
- Press a key.
- Choose Enroll MOK, then Continue, then Yes.
- When it asks for a password, type
boot. Nothing shows while you type. - Choose Reboot. You will not see this screen again.
Missed it, or chose the wrong option? Open a terminal, run wol boot enroll, and restart: the screen comes back once more.
Starting the live USB stick
The live image is not signed yet: the live image key is prepared but not issued. Until it is, start the USB stick with Secure Boot off in the firmware settings, or with the firmware in Setup Mode. Install, and at the first start of the installed system follow the key screen above.
When signed live images ship, the stick itself shows a blue screen once: press a key, choose Enroll key from disk, pick the stick, then EFI\BOOT\wolos-secureboot.cer, Continue, Yes, and Reboot. The file README-SECURE-BOOT.txt on the stick says the same.
What signing protects
On signed tiers the kernel runs with lockdown=integrity and accepts only signed modules. The system seal and an anti-rollback number are part of the signed command line, so an older, retired system copy cannot be started again. The disk key follows signed kernels: updates keep unlocking the disk; a changed kernel, command line or initramfs does not.
Known costs: lockdown=integrity blocks hibernation, and out-of-tree drivers such as NVIDIA's need the same key screen once.