Arch Linux does not configure Secure Boot by default, requiring users to either disable it or manually sign boot images. A common approach involves using the sbctl tool to replace factory UEFI keys with custom ones, though this carries risks of system instability.
The author proposes a method of adding a custom Arch Linux key to the existing UEFI database without removing factory or Microsoft certificates. This process requires a motherboard with UEFI key management support, such as the ASUS Prime 790-P, and a FAT-formatted USB drive for backups.
The setup involves generating RSA 4096-bit keys using OpenSSL and adding the public key to the UEFI DB section. To ensure persistence, the author implements a custom mkinitcpio post-hook script that automatically signs the Unified Kernel Image (UKI) whenever the kernel is updated.
This configuration allows for Secure Boot functionality while maintaining the original factory key chain. The automated signing process ensures that new kernel versions are signed immediately upon installation via the package manager.
