# Secure Boot

> Every computer makes its own boot keys. At most one key screen, once, with the password boot.

Source: https://wolos.pages.dev/manual/secure-boot

## What it is

Secure Boot is the firmware check that lets only signed code start your computer. WolOS signs its boot images with keys made **on your computer, at install**. No image carries a shared WolOS key, and no two computers share one.

## Why

A vendor key that signs every copy of a system is one secret that, once leaked, unlocks every copy. A key per computer has no such single point. The price is that the computer signs its own updates, so its key lives on it, encrypted to the TPM chip when there is one.

## How

The installer picks the simplest path your firmware allows (`wol boot detect`):

| Your firmware | What happens |
|---|---|
| In *Setup Mode* | This computer's keys are enrolled next to Microsoft's. No key screen. |
| Secure Boot on, or off with Microsoft's third-party certificate present (most PCs) | A signed, unmodified first stage starts WolOS's loader. You confirm the key **once**, on a blue screen at the first start. |
| Neither | WolOS starts without signatures and Settings says so. |
| Secure Boot on and nothing above fits | A firmware setting has to change first; the installer says which. |

### The key screen, step by step

After the restart a blue screen appears. It comes from your computer's firmware, not from WolOS, and it waits for you.

1. Press a key.
2. Choose **Enroll MOK**, then **Continue**, then **Yes**.
3. When it asks for a password, type `boot`. Nothing shows while you type.
4. Choose **Reboot**. You will not see this screen again.

Missed it, or chose the wrong option? Open a terminal, run `wol boot enroll`, and restart: the screen comes back once more.

### Starting the live USB stick

The live image is not signed yet: the live image key is prepared but not issued. Until it is, start the USB stick with Secure Boot **off** in the firmware settings, or with the firmware in Setup Mode. Install, and at the first start of the installed system follow the key screen above.

When signed live images ship, the stick itself shows a blue screen once: press a key, choose **Enroll key from disk**, pick the stick, then `EFI\BOOT\wolos-secureboot.cer`, **Continue**, **Yes**, and **Reboot**. The file `README-SECURE-BOOT.txt` on the stick says the same.

### What signing protects

On signed tiers the kernel runs with `lockdown=integrity` and accepts only signed modules. The system seal and an anti-rollback number are part of the signed command line, so an older, retired system copy cannot be started again. The disk key follows signed kernels: updates keep unlocking the disk; a changed kernel, command line or initramfs does not.

Known costs: `lockdown=integrity` blocks hibernation, and out-of-tree drivers such as NVIDIA's need the same key screen once.