# Enter BIOS
# Secure Boot Configuration -> Reset secure boot keys.
.
# Install sbctl
sudo pacman -Sy sbctl
.
# Grant yourself root privileges
sudo -i
.
sbctl status
# shows current status (initially all three red X)
.
# create secure boot keys
sbctl create-keys
# should report "secure boot keys created"
.
# enroll keys to EFI
sbctl enroll-keys -m
.
# sign boot files
sbctl sign -s -o /usr/lib/systemd/boot/efi/systemd-bootx64.efi.signed /usr/lib/systemd/boot/efi/systemd-bootx64.efi
# should report "signed /usr..." with green tick
.
# find where your kernel imige is
cat /etc/mkinitcpio.d/linux.preset
# should look for 'default' and uncommented image/efi file
# sign that file too
sbctl sign -s [path to that file/filename]
# should report "signed [filename]" with green tick
#NOTE: The error unrecognized PE machine: 0x3730 typically occurs when sbctl attempts to read a file that it expects to be a Portable Executable (PE) binary, but the file is either not a binary or is in a format sbctl does not support.
#Check the File Type: Verify that the file you are trying to sign is actually an EFI executable. You can use the file command:
file /path/to/your/file
#It should report something like PE32+ executable (EFI application) x86-64. If it says data or ASCII text, it cannot be signed by sbctl.
#This is common for files like initramfs-linux.img or amd-ucode.img, which are not EFI binaries and do not need to be signed individually unless they are part of a Unified Kernel Image (UKI).
#Ensure EFISTUB Support: If you are trying to sign your Linux kernel (e.g., vmlinuz-linux), ensure it was compiled with CONFIG_EFI_STUB=y. Without this, the kernel is not a valid EFI binary and sbctl will fail to parse it.
.
# reinstall bootloader
bootctl install
.
# verify everything is done correct
sbctl verify
# should report all green ticks
.
# reboot
.
# check secure boot is activated
sbctl status
# should report all green ticks with 'Owner GUID'
.
# reinstall the kernel
sudo pacman -S linux
# should report 'Signed'