rEFInd secure boot on bazzite #452

zany130 · 2025-08-07T21:16:28Z

zany130
Aug 7, 2025

Hi all, I'm having an issue getting Secure Boot working properly with rEFInd on my Bazzite system using sbctl.

Due to a GRUB bug with my ASRock board (specifically when Fast Boot is enabled), the keyboard doesn't work in the GRUB menu—so the system just auto-boots into Bazzite, and I can’t select any other entries.

As a workaround, I’ve been booting into rEFInd first (which does detect my keyboard properly), and then chainloading into GRUB to start Bazzite.

Before updating the BIOS, I was able to boot into rEFInd and chainload into GRUB just fine using sbctl. But after the BIOS update, here's what’s happening now:

I can boot GRUB directly with Secure Boot enabled—no issues, other than the keyboard not working.

I can boot rEFInd directly (signed via sbctl) with Secure Boot enabled—works fine.

If I disable Secure Boot, rEFInd can chainload into GRUB and Bazzite boots successfully.

Problem: With Secure Boot enabled, chainloading GRUB from rEFInd fails with an error about being unable to load the kernel.

I followed the advice from issue #443 to reset Secure Boot keys and resign everything from scratch, but the issue persists I also tried uninstalling and reinstalling refind with no luck.

Here's the output of sbctl verify and sbctl status. I wasn't getting all those pe errors before so they might be relevant?

Thanks in advance!

 sudo sbctl verify                                                                                                                                                                                           ─╯
[sudo] password for zany130:           
Verifying file database and EFI images in /boot/efi...
✓ /boot/efi/EFI/fedora/shimia32.efi is signed
✓ /boot/efi/EFI/tools/gdisk_x64.efi is signed
✓ /boot/efi/EFI/fedora/mmia32.efi is signed
✓ /boot/efi/EFI/fedora/shim.efi is signed
✓ /boot/efi/EFI/tools/iPXE.efi is signed
✓ /boot/efi/EFI/tools/shell.efi is signed
✓ /boot/efi/shellx64.efi is signed
✓ /boot/efi/EFI/BOOT/BOOTX64.EFI is signed
✓ /boot/efi/EFI/BOOT/fbx64.efi is signed
✓ /boot/efi/EFI/fedora/shimx64.efi is signed
✓ /boot/efi/EFI/tools/memtest86+x64.efi is signed
✓ /boot/efi/EFI/fedora/grubia32.efi is signed
✓ /boot/efi/EFI/refind/refind_x64.efi is signed
✓ /boot/efi/EFI/tools/gptsync_x64.efi is signed
✓ /boot/efi/EFI/tools/netboot.xyz-snponly.efi is signed
✓ /boot/efi/EFI/refind/drivers_x64/ext4_x64.efi is signed
✓ /boot/efi/EFI/tools/ReadVars.efi is signed
✓ /boot/efi/EFI/BOOT/BOOTIA32.EFI is signed
✓ /boot/efi/EFI/BOOT/fbia32.efi is signed
✓ /boot/efi/EFI/fedora/grubx64.efi is signed
✓ /boot/efi/EFI/fedora/mmx64.efi is signed
failed to verify file /boot/efi/EFI/fedora/BOOTIA32.CSV: /boot/efi/EFI/fedora/BOOTIA32.CSV: invalid pe header
failed to verify file /boot/efi/EFI/fedora/BOOTX64.CSV: /boot/efi/EFI/fedora/BOOTX64.CSV: invalid pe header
failed to verify file /boot/efi/EFI/fedora/bootuuid.cfg: /boot/efi/EFI/fedora/bootuuid.cfg: invalid pe header
failed to verify file /boot/efi/EFI/fedora/grub.cfg: /boot/efi/EFI/fedora/grub.cfg: invalid pe header
failed to verify file /boot/efi/EFI/refind/BOOT.CSV: /boot/efi/EFI/refind/BOOT.CSV: invalid pe header
failed to verify file /boot/efi/EFI/refind/background.png: /boot/efi/EFI/refind/background.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/README: /boot/efi/EFI/refind/icons/README: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/arrow_left.png: /boot/efi/EFI/refind/icons/arrow_left.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/arrow_right.png: /boot/efi/EFI/refind/icons/arrow_right.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/boot_linux.png: /boot/efi/EFI/refind/icons/boot_linux.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/boot_win.png: /boot/efi/EFI/refind/icons/boot_win.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/func_about.png: /boot/efi/EFI/refind/icons/func_about.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/func_bootorder.png: /boot/efi/EFI/refind/icons/func_bootorder.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/func_csr_rotate.png: /boot/efi/EFI/refind/icons/func_csr_rotate.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/func_exit.png: /boot/efi/EFI/refind/icons/func_exit.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/func_firmware.png: /boot/efi/EFI/refind/icons/func_firmware.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/func_hidden.png: /boot/efi/EFI/refind/icons/func_hidden.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/func_install.png: /boot/efi/EFI/refind/icons/func_install.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/func_reset.png: /boot/efi/EFI/refind/icons/func_reset.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/func_shutdown.png: /boot/efi/EFI/refind/icons/func_shutdown.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/licenses/cc-3.0.txt: /boot/efi/EFI/refind/icons/licenses/cc-3.0.txt: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/licenses/cc-by-sa-4.0.txt: /boot/efi/EFI/refind/icons/licenses/cc-by-sa-4.0.txt: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/licenses/gpl-2.0.txt: /boot/efi/EFI/refind/icons/licenses/gpl-2.0.txt: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/licenses/gpl-3.0.txt: /boot/efi/EFI/refind/icons/licenses/gpl-3.0.txt: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/licenses/lgpl-3.0.txt: /boot/efi/EFI/refind/icons/licenses/lgpl-3.0.txt: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/mouse.png: /boot/efi/EFI/refind/icons/mouse.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_arch.png: /boot/efi/EFI/refind/icons/os_arch.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_artful.png: /boot/efi/EFI/refind/icons/os_artful.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_bionic.png: /boot/efi/EFI/refind/icons/os_bionic.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_centos.png: /boot/efi/EFI/refind/icons/os_centos.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_chakra.png: /boot/efi/EFI/refind/icons/os_chakra.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_chrome.png: /boot/efi/EFI/refind/icons/os_chrome.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_clover.png: /boot/efi/EFI/refind/icons/os_clover.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_crunchbang.png: /boot/efi/EFI/refind/icons/os_crunchbang.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_debian.png: /boot/efi/EFI/refind/icons/os_debian.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_devuan.png: /boot/efi/EFI/refind/icons/os_devuan.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_elementary.png: /boot/efi/EFI/refind/icons/os_elementary.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_endeavouros.png: /boot/efi/EFI/refind/icons/os_endeavouros.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_fedora.png: /boot/efi/EFI/refind/icons/os_fedora.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_freebsd.png: /boot/efi/EFI/refind/icons/os_freebsd.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_frugalware.png: /boot/efi/EFI/refind/icons/os_frugalware.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_gentoo.png: /boot/efi/EFI/refind/icons/os_gentoo.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_gummiboot.png: /boot/efi/EFI/refind/icons/os_gummiboot.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_haiku.png: /boot/efi/EFI/refind/icons/os_haiku.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_hwtest.png: /boot/efi/EFI/refind/icons/os_hwtest.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_kubuntu.png: /boot/efi/EFI/refind/icons/os_kubuntu.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_legacy.png: /boot/efi/EFI/refind/icons/os_legacy.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_linux.png: /boot/efi/EFI/refind/icons/os_linux.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_linuxmint.png: /boot/efi/EFI/refind/icons/os_linuxmint.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_lubuntu.png: /boot/efi/EFI/refind/icons/os_lubuntu.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_mac.png: /boot/efi/EFI/refind/icons/os_mac.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_mageia.png: /boot/efi/EFI/refind/icons/os_mageia.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_mandriva.png: /boot/efi/EFI/refind/icons/os_mandriva.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_manjaro.png: /boot/efi/EFI/refind/icons/os_manjaro.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_netbsd.png: /boot/efi/EFI/refind/icons/os_netbsd.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_network.png: /boot/efi/EFI/refind/icons/os_network.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_opensuse.png: /boot/efi/EFI/refind/icons/os_opensuse.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_redhat.png: /boot/efi/EFI/refind/icons/os_redhat.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_refind.png: /boot/efi/EFI/refind/icons/os_refind.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_refit.png: /boot/efi/EFI/refind/icons/os_refit.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_slackware.png: /boot/efi/EFI/refind/icons/os_slackware.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_suse.png: /boot/efi/EFI/refind/icons/os_suse.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_systemd.png: /boot/efi/EFI/refind/icons/os_systemd.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_trusty.png: /boot/efi/EFI/refind/icons/os_trusty.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_ubuntu.png: /boot/efi/EFI/refind/icons/os_ubuntu.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_uefi.png: /boot/efi/EFI/refind/icons/os_uefi.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_unknown.png: /boot/efi/EFI/refind/icons/os_unknown.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_void.png: /boot/efi/EFI/refind/icons/os_void.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_win.png: /boot/efi/EFI/refind/icons/os_win.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_win8.png: /boot/efi/EFI/refind/icons/os_win8.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_xenial.png: /boot/efi/EFI/refind/icons/os_xenial.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_xubuntu.png: /boot/efi/EFI/refind/icons/os_xubuntu.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/os_zesty.png: /boot/efi/EFI/refind/icons/os_zesty.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/tool_apple_rescue.png: /boot/efi/EFI/refind/icons/tool_apple_rescue.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/tool_fwupdate.png: /boot/efi/EFI/refind/icons/tool_fwupdate.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/tool_memtest.png: /boot/efi/EFI/refind/icons/tool_memtest.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/tool_mok_tool.png: /boot/efi/EFI/refind/icons/tool_mok_tool.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/tool_netboot.png: /boot/efi/EFI/refind/icons/tool_netboot.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/tool_part.png: /boot/efi/EFI/refind/icons/tool_part.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/tool_rescue.png: /boot/efi/EFI/refind/icons/tool_rescue.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/tool_shell.png: /boot/efi/EFI/refind/icons/tool_shell.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/tool_windows_rescue.png: /boot/efi/EFI/refind/icons/tool_windows_rescue.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/transparent.png: /boot/efi/EFI/refind/icons/transparent.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/vol_efi.png: /boot/efi/EFI/refind/icons/vol_efi.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/vol_external.png: /boot/efi/EFI/refind/icons/vol_external.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/vol_internal.png: /boot/efi/EFI/refind/icons/vol_internal.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/vol_net.png: /boot/efi/EFI/refind/icons/vol_net.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/icons/vol_optical.png: /boot/efi/EFI/refind/icons/vol_optical.png: invalid pe header
failed to verify file /boot/efi/EFI/refind/refind.conf: /boot/efi/EFI/refind/refind.conf: invalid pe header
failed to verify file /boot/efi/EFI/refind/vars/PreviousBoot: /boot/efi/EFI/refind/vars/PreviousBoot: invalid pe header
✗ /boot/efi/EFI/tools/HashTool.efi is not signed
✗ /boot/efi/EFI/tools/HelloWorld.efi is not signed
✗ /boot/efi/EFI/tools/KeyTool.efi is not signed
✗ /boot/efi/EFI/tools/Loader.efi is not signed
✗ /boot/efi/EFI/tools/LockDown.efi is not signed
✗ /boot/efi/EFI/tools/PreLoader.efi is not signed
✗ /boot/efi/EFI/tools/SetNull.efi is not signed
✗ /boot/efi/EFI/tools/ShimReplace.efi is not signed
✗ /boot/efi/EFI/tools/UpdateVars.efi is not signed
✗ /boot/efi/EFI/tools/fbx64.efi is not signed
✗ /boot/efi/EFI/tools/fwupdx64.efi is not signed
✗ /boot/efi/EFI/tools/mmx64.efi is not signed
✗ /boot/efi/EFI/tools/shimx64.efi is not signed

╭─    ~ ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────  4s  05:00:10 PM ─╮
╰─❯ sbctl status                                                                                                                                                                                                ─╯
Installed:	✓ sbctl is installed
Owner GUID:	***************
Setup Mode:	✓ Disabled
Secure Boot:	✓ Enabled
Vendor Keys:	Microsoft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

rEFInd secure boot on bazzite #452

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

rEFInd secure boot on bazzite #452

Uh oh!

zany130 Aug 7, 2025

Replies: 0 comments

zany130
Aug 7, 2025