#Secure Boot

---

##to be clear, i do not like secure boot, for three reasons.
- motherboards come with microsoft certificates, so other operating systems are disadvantaged
- certificates are both time limited, and can be revoked by a bios update.
- there is extra invenience signing kernels you compile yourself.

###in more detail:
1. although it is possible to manually add a bootloader to many bioses, it is inconvenient.
because of the certs issue, many linux distro's either sign their kernel with a microsoft certificate which they have to buy, or they use a shim, which itself has a microsoft certificate. This makes your opensource system beholden to Microsoft, a very large commercial corporation, who sell a competing commercial closed source operating system, somewhat ironically, and gives them power which I don't think they should have.
(to be clear, Microsoft does contribute to the linux kernel, and uses azure, their own linux distro, so they are using as well as controlling).

2. the concept that your computer may not boot, not because of a hardware failure, but because the date is wrong, or another company decided to revoke their certificate is not a nice thought.
---
Because Microsoft enjoys a virtual monopoly in the desktop computing space, their operating system defaults to secure boot, over which they have a large amount of control. It is still possible to install windows in legacy mode, and/or without secure boot, but they are adding features which will be disabled for customers who don't use secure boot.

3. unless you follow the method to enroll kernels to the key management in the uefi bios, you need to sign them, and enroll your signing key instead. This allows you to experiment with different self-built kernels without constantly having to add them to the bios, but it adds the inconvenience of having to sign the kernels.

##you got this far, so you are committed to using secure boot!
That said, it is possible in a number of uefi bios's to add a efi executable to the list of allowed boot executables.
Your linux distro will need to boot without secure boot initially, in order for elilong to add it's entry into the uefi bios, and be copied to the efi system partition by elilongsetup. once this is done, you enable secureboot and add elilong.efi and the kernels you wish to boot to the allowed efi images.

##instructions for particular motherboards

#Asrock B650M PG lightning (may work for other am5 asrock motherboards)
- enter the bios by frantically pressing del at startup.
- go to security tab. if you haven't enabled secure boot before, select "install default secure boot keys" and click "yes". it will then restart, so you'll have to do the "del" thing to get back in to the bios
- in "security" "secure boot" change it to "enable".
- click "expert key management" - click "enroll efi image" - select your boot device
- for slackware, select EFI, then select Slackware, then select "elilong.efi" and click "yes", and "ok"
- for arch, select EFI, then select arch, then select "elilong.efi" and click "yes", and "ok"
- for other distros, select EFI, then select elilong, then select "elilong.efi" and click "yes", and "ok"
- *for each kernel you want to be able to boot*, repeat the process of enrolling efi image, but select the kernel you want to boot, eg "vmlinuz" instead of "elilong.efi" in the appropriate directory
- then go to "exit" and "save changes and exit" and click "yes"
your system should now boot elilong with secureboot

**IMPORTANT NOTE** If you have secure boot enabled, you will have to repeat the enrollment of elilong whenever you install a newer version of elilong, and you will have to repeat the enrollment for each new kernel you wish to boot.
