callamon I hear you! Multiboot is how I'm rolling right now with one of my two GhostBSD installs. Bare metal.

I want that as I am looking to gain 3d acceleration for some apps and future work. I cannot do that effectively with a VM install, passthrough is a PITA. Similar to yours, Win11 Home, Lubuntu LTS and GhostBSD.

Edit, if you install with a multiboot setup, make sure you install ReFind. Installing the BSD bootloader only will overwrite the Windows bootloader and Grub for Lubuntu. Not easy to replace those if they're accidentally deleted.

You can drop GRUB on Linux and use rEFInd instead; rEFInd detects GhostBSD automatically. That's my new recommendation for Linux users who want to multiboot.

DHOC_TAZH If you want you can look into adding support by:

• Creating your own Secure Boot keys (PK, KEK, DB)
• Signing GhostBSD's loader.efi with your DB key
• Preparing the ESP to work with shimx64.efi and mmx64.efi

Here's an early prototype script. Feel free to improve it.

#!/bin/sh

# Secure Boot Setup Script for GhostBSD
# Author: Sho Kami Sei and Ghostfixer
# License: BSD 3-Clause

set -e
trap 'echo "Script aborted."; exit 1' INT TERM

# === Configuration ===
KEYDIR="$HOME/secureboot/keys"
ESP_DIR="/boot/efi"
GHOSTBSD_LOADER="$ESP_DIR/EFI/ghostbsd/loader.efi"
SIGNED_LOADER="$ESP_DIR/EFI/ghostbsd/loader.signed.efi"
BOOT_DIR="$ESP_DIR/EFI/Boot"
SHIM_URL="https://cdimage.ubuntu.com/releases/22.04/release/ubuntu-22.04.3-live-server-amd64.iso"

# === Helper Functions ===
require_tool() {
  if ! command -v "$1" >/dev/null 2>&1; then
    echo "Required tool '$1' is not installed. Please install it first."
    exit 1
  fi
}

log_step() {
  echo
  echo "$1"
  echo "----------------------------------------"
}

fail_if_missing() {
  if [ ! -f "$1" ]; then
    echo "Missing required file: $1"
    exit 1
  fi
}

# === Checks ===
log_step "[0] Verifying environment..."

for tool in openssl cert-to-efi-sig-list sign-efi-sig-list sbsign; do
  require_tool "$tool"
done

fail_if_missing "$GHOSTBSD_LOADER"

# === Step 1: Create Key Directory ===
log_step "[1] Creating key directory..."
mkdir -p "$KEYDIR"
cd "$KEYDIR" || exit 1

# === Step 2: Generate Keys ===
log_step "[2] Generating Secure Boot keys (PK, KEK, DB)..."

openssl req -new -x509 -newkey rsa:2048 -nodes -keyout PK.key -out PK.crt -days 3650 -subj "/CN=GhostBSD PK/"
openssl req -new -x509 -newkey rsa:2048 -nodes -keyout KEK.key -out KEK.crt -days 3650 -subj "/CN=GhostBSD KEK/"
openssl req -new -x509 -newkey rsa:2048 -nodes -keyout DB.key -out DB.crt -days 3650 -subj "/CN=GhostBSD DB/"

# === Step 3: Create .auth and .esl Files ===
log_step "[3] Creating UEFI .auth and .esl files..."

cert-to-efi-sig-list -g "$(uuidgen)" PK.crt PK.esl
cert-to-efi-sig-list -g "$(uuidgen)" KEK.crt KEK.esl
cert-to-efi-sig-list -g "$(uuidgen)" DB.crt DB.esl

sign-efi-sig-list -k PK.key -c PK.crt PK PK.esl PK.auth
sign-efi-sig-list -k KEK.key -c KEK.crt KEK KEK.esl KEK.auth
sign-efi-sig-list -k DB.key -c DB.crt db DB.esl DB.auth

# === Step 4: Sign loader.efi ===
log_step "[4] Signing GhostBSD loader.efi..."

cp "$GHOSTBSD_LOADER" "$KEYDIR/loader-original.efi"
sbsign --key DB.key --cert DB.crt --output "$SIGNED_LOADER" "$GHOSTBSD_LOADER"
mv "$SIGNED_LOADER" "$GHOSTBSD_LOADER"

# === Step 5: Manual shim Setup ===
log_step "[5] Setting up shim and mm... (manual step)"

mkdir -p "$BOOT_DIR"

echo "Please manually obtain shimx64.efi and mmx64.efi:"
echo "   - Mount and extract from:"
echo "     $SHIM_URL"
echo "   - Or download shim-signed from:"
echo "     https://packages.ubuntu.com/search?keywords=shim-signed"
echo
echo "Then copy them into:"
echo "   cp shimx64.efi $BOOT_DIR/BOOTX64.EFI"
echo "   cp mmx64.efi $BOOT_DIR/mmx64.efi"
echo "   cp $GHOSTBSD_LOADER $BOOT_DIR/grubx64.efi  # or configure shim to load loader.efi"
echo

# === Step 6: Summary and Key Enrollment ===
log_step "[6] Done. Final steps:"

echo "Secure Boot key files are in: $KEYDIR"
echo "Copy these to a USB stick for enrollment using KeyTool.efi or UEFI setup:"
echo "   $KEYDIR/PK.auth"
echo "   $KEYDIR/KEK.auth"
echo "   $KEYDIR/DB.auth"
echo
echo "You can now reboot and enroll your keys. After that, enable Secure Boot in firmware."

How to Install rEFInd on Lubuntu: Making GhostBSD a secondary boot option

This guide helps you install rEFInd on Linux to make booting GhostBSD alongside Linux easier; especially if GRUB isn't detecting it properly.

Step 1: Install Required Tools

Open a terminal and run:

sudo apt update
sudo apt install refind

This installs rEFInd and its configuration utilities.

Step 2: Install rEFInd to the EFI System Partition (ESP)

Run the rEFInd install script:

sudo refind-install

This copies rEFInd to /boot/efi/EFI/refind/ and sets it as the default EFI bootloader (does not remove GRUB).

If You See an Error Like:

• “Not installing to the ESP” or

• “ESP not mounted”

You may need to manually mount your EFI partition:

sudo mkdir -p /boot/efi
sudo mount /dev/sdXY /boot/efi

Replace /dev/sdXY with your EFI partition (usually something like /dev/sda1, type vfat and around 512MB).

Then rerun:

sudo refind-install

Step 3: Reboot and Use rEFInd

Reboot your machine:

sudo reboot

You should now see the rEFInd boot menu with entries for LMDE, FreeBSD, and other installed systems.

If GhostBSD doesn't appear:

• Press F2 to refresh

• Press F10 to view boot options

Why Use rEFInd?

• Graphical EFI boot manager with theme support

• Auto-detects FreeBSD, GhostBSD, Linux, Windows, and more

• Clean interface with easy fallback to GRUB if needed

No.