Enable Secure Boot on Nobara Linux

NOTE: There are a couple steps in this video which are no longer necessary! Nobara now includes sbctl in its repos. This means you can skip step 2 below. And best of all, this version of sbctl (from the terra group) has a fixed auto-sign script. This means you can skip steps 10, 11, and 12! If you need secure boot enabled on your machine (say if you want to play games that require kernel level anti-cheat), this easy process will let you boot both Windows and Nobara Linux, leaving Secure Boot enabled for both. tl/dr: 1) Boot into your motherboard bios. Turn off secure boot, but enable key management. Delete all existing keys (AFTER YOU MAKE SURE YOU DON'T HAVE BITLOCKER ENCRYPTED DRIVES). Exit and boot into Nobara. 2) Add the sbctl copr to your repositories: sudo dnf copr enable chenxiaolong/sbctl 3) Install sbctl: sudo dnf in sbctl 4) Initialize the key database: sudo sbctl create-keys 5) Enroll microsoft keys: sudo sbctl enroll-keys -m 5) Determine current kernel: uname -r 6) Sign current kernel: sudo sbctl sign -s /boot/vmlinuz-6.19.2-200.nobara.fc43.x86_64 7) Sign grub .efi program: sudo sbctl sign -s /boot/efi/EFI/fedora/grubx64.efi 8) Boot back into bios, enable secure boot, save and exit back to Linux 9) Verify secure boot is working: sudo sbctl status 10) Create auto-sign script /etc/kernel/install.d/99-sign-kernel.install: #!/bin/bash for kernel in /boot/vmlinuz-*; do /usr/bin/sbctl sign -s "$kernel" done 11) Make the script executable: sudo chmod u+x /etc/kernel/install.d/99-sign-kernel.install 12) Run the script, verify it works: sudo /etc/kernel/install.d/99-sign-kernel.install