Garuda-bootctl-dracut fails with dracut error and signing issues

Fresh install, no updates after install as I am using the latest up to date iso, right after installation it was the first thing I tried to install and it is failing to sign the keys

System:
Kernel: 6.15.4-zen2-1-zen arch: x86_64 bits: 64 compiler: gcc v: 15.1.1
clocksource: tsc avail: hpet,acpi_pm
parameters: BOOT_IMAGE=/@/boot/vmlinuz-linux-zen
root=UUID=5f72b5ca-0f11-4e79-a893-d5ef05e60d42 rw rootflags=subvol=@
quiet loglevel=3 ibt=off
Desktop: KDE Plasma v: 6.4.1 tk: Qt v: N/A wm: kwin_wayland dm: SDDM
Distro: Garuda base: Arch Linux
Machine:
Type: Desktop Mobo: ASUSTeK model: MAXIMUS IX HERO v: Rev 1.xx
serial: <filter> part-nu: SKU uuid: 9df7b6e0-d7da-11dd-99f5-2c4d5499f2f7
UEFI: American Megatrends v: 1301 date: 03/14/2018
CPU:
Info: model: Intel Core i7-7700K socket: LGA1151 bits: 64 type: MT MCP
arch: Kaby Lake gen: core 7 level: v3 note: check built: 2018
process: Intel 14nm family: 6 model-id: 0x9E (158) stepping: 9
microcode: 0xF8
Topology: cpus: 1x dies: 1 clusters: 4 cores: 4 threads: 8 tpc: 2
smt: enabled cache: L1: 256 KiB desc: d-4x32 KiB; i-4x32 KiB L2: 1024 KiB
desc: 4x256 KiB L3: 8 MiB desc: 1x8 MiB
Speed (MHz): avg: 800 min/max: 800/4800 base/boost: 4800/8300 scaling:
driver: intel_pstate governor: powersave volts: 1.3 V ext-clock: 100 MHz
cores: 1: 800 2: 800 3: 800 4: 800 5: 800 6: 800 7: 800 8: 800
bogomips: 67200
Flags: avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx
Vulnerabilities: <filter>
Graphics:
Device-1: NVIDIA AD104 [GeForce RTX 4070 SUPER] vendor: ASUSTeK
driver: nvidia v: 575.64 alternate: nouveau,nvidia_drm non-free: 550-570.xx+
status: current (as of 2025-04) arch: Lovelace code: AD1xx
process: TSMC n4 (5nm) built: 2022+ pcie: gen: 3 speed: 8 GT/s lanes: 16
link-max: gen: 4 speed: 16 GT/s ports: active: none
off: DP-1,DP-2,HDMI-A-1 empty: DP-3 bus-ID: 01:00.0 chip-ID: 10de:2783
class-ID: 0300
Display: unspecified server: X.Org v: 24.1.8 with: Xwayland v: 24.1.8
compositor: kwin_wayland driver: X: loaded: nvidia unloaded: modesetting
alternate: fbdev,nouveau,nv,vesa gpu: nvidia,nvidia-nvswitch
display-ID: :1 screens: 1
Screen-1: 0 s-res: 5760x1080 s-dpi: 96 s-size: 1524x286mm (60.00x11.26")
s-diag: 1551mm (61.05")
Monitor-1: DP-1 note: disabled pos: right model: BenQ ZOWIE XL LCD
serial: <filter> built: 2019 res: mode: 1920x1080 hz: 60 scale: 100% (1)
dpi: 92 gamma: 1.2 size: 531x298mm (20.91x11.73") diag: 609mm (24")
ratio: 16:9 modes: max: 1920x1080 min: 640x480
Monitor-2: DP-2 note: disabled pos: left model: BenQ ZOWIE XL LCD
serial: <filter> built: 2019 res: mode: 1920x1080 hz: 60 scale: 100% (1)
dpi: 92 gamma: 1.2 size: 531x298mm (20.91x11.73") diag: 609mm (24")
ratio: 16:9 modes: max: 1920x1080 min: 640x480
Monitor-3: HDMI-A-1 note: disabled pos: primary,center model: Samsung
built: 2012 res: mode: 1920x1080 hz: 60 scale: 100% (1) dpi: 46 gamma: 1.2
size: 1060x626mm (41.73x24.65") diag: 1021mm (40.2") ratio: 16:9 modes:
max: 1920x1080 min: 640x480
API: EGL v: 1.5 hw: drv: nvidia platforms: device: 0 drv: nvidia device: 2
drv: swrast gbm: drv: nvidia surfaceless: drv: nvidia x11: drv: nvidia
inactive: wayland,device-1
API: OpenGL v: 4.6.0 compat-v: 4.5 vendor: nvidia mesa v: 575.64
glx-v: 1.4 direct-render: yes renderer: NVIDIA GeForce RTX 4070
SUPER/PCIe/SSE2 memory: 11.71 GiB
API: Vulkan v: 1.4.313 layers: 7 device: 0 type: discrete-gpu name: NVIDIA
GeForce RTX 4070 SUPER driver: nvidia v: 575.64 device-ID: 10de:2783
surfaces: N/A device: 1 type: cpu name: llvmpipe (LLVM 20.1.6 256 bits)
driver: mesa llvmpipe v: 25.1.4-arch1.1 (LLVM 20.1.6)
device-ID: 10005:0000 surfaces: N/A
Info: Tools: api: clinfo, eglinfo, glxinfo, vulkaninfo
de: kscreen-console,kscreen-doctor gpu: nvidia-settings,nvidia-smi
wl: wayland-info x11: xdpyinfo, xprop, xrandr
Audio:
Device-1: Intel 200 Series PCH HD Audio vendor: ASUSTeK
driver: snd_hda_intel v: kernel alternate: snd_soc_avs bus-ID: 00:1f.3
chip-ID: 8086:a2f0 class-ID: 0403
Device-2: NVIDIA AD104 High Definition Audio vendor: ASUSTeK
driver: snd_hda_intel v: kernel pcie: gen: 3 speed: 8 GT/s lanes: 16
link-max: gen: 4 speed: 16 GT/s bus-ID: 01:00.1 chip-ID: 10de:22bc
class-ID: 0403
Device-3: SteelSeries ApS Arctis Nova 7
driver: hid-generic,snd-usb-audio,usbhid type: USB rev: 2.0 speed: 12 Mb/s
lanes: 1 mode: 1.1 bus-ID: 3-1:2 chip-ID: 1038:2202 class-ID: 0300
API: ALSA v: k6.15.4-zen2-1-zen status: kernel-api tools: N/A
Server-1: PipeWire v: 1.4.6 status: n/a (root, process) with:
1: pipewire-pulse status: active 2: wireplumber status: active
3: pipewire-alsa type: plugin 4: pw-jack type: plugin
tools: pactl,pw-cat,pw-cli,wpctl
Network:
Device-1: Intel Ethernet I219-V vendor: ASUSTeK driver: e1000e v: kernel
port: N/A bus-ID: 00:1f.6 chip-ID: 8086:15b8 class-ID: 0200
IF: enp0s31f6 state: up speed: 1000 Mbps duplex: full mac: <filter>
Info: services: NetworkManager, smbd, systemd-timesyncd
Bluetooth:
Device-1: Intel Wireless-AC 9260 Bluetooth Adapter driver: btusb v: 0.8
type: USB rev: 2.0 speed: 12 Mb/s lanes: 1 mode: 1.1 bus-ID: 1-11:4
chip-ID: 8087:0025 class-ID: e001
Report: btmgmt ID: hci0 rfk-id: 0 state: up address: N/A
Drives:
Local Storage: total: 2.79 TiB used: 6.56 GiB (0.2%)
ID-1: /dev/nvme0n1 maj-min: 259:3 vendor: A-Data model: SX8200PNP
size: 953.87 GiB block-size: physical: 512 B logical: 512 B speed: 31.6 Gb/s
lanes: 4 tech: SSD serial: <filter> fw-rev: S0118C temp: 32.9 C
scheme: GPT
SMART: yes health: PASSED on: 4y 191d 14h cycles: 3,482
read-units: 309,986,236 [158 TB] written-units: 370,040,330 [189 TB]
ID-2: /dev/nvme1n1 maj-min: 259:0 vendor: Seagate
model: XPG GAMMIX S70 BLADE size: 1.86 TiB block-size: physical: 512 B
logical: 512 B speed: 63.2 Gb/s lanes: 4 tech: SSD serial: <filter>
fw-rev: 3.2.J.JE temp: 48.9 C scheme: GPT
SMART: yes health: PASSED on: 169d 23h cycles: 496
read-units: 36,168,371 [18.5 TB] written-units: 36,904,960 [18.8 TB]
Partition:
ID-1: / raw-size: 1.86 TiB size: 1.86 TiB (100.00%) used: 6.56 GiB (0.3%)
fs: btrfs block-size: 4096 B dev: /dev/nvme1n1p2 maj-min: 259:2
ID-2: /boot/efi raw-size: 300 MiB size: 299.4 MiB (99.80%)
used: 588 KiB (0.2%) fs: vfat block-size: 512 B dev: /dev/nvme1n1p1
maj-min: 259:1
ID-3: /home raw-size: 1.86 TiB size: 1.86 TiB (100.00%)
used: 6.56 GiB (0.3%) fs: btrfs block-size: 4096 B dev: /dev/nvme1n1p2
maj-min: 259:2
ID-4: /var/log raw-size: 1.86 TiB size: 1.86 TiB (100.00%)
used: 6.56 GiB (0.3%) fs: btrfs block-size: 4096 B dev: /dev/nvme1n1p2
maj-min: 259:2
ID-5: /var/tmp raw-size: 1.86 TiB size: 1.86 TiB (100.00%)
used: 6.56 GiB (0.3%) fs: btrfs block-size: 4096 B dev: /dev/nvme1n1p2
maj-min: 259:2
Swap:
Kernel: swappiness: 133 (default 60) cache-pressure: 100 (default) zswap: no
ID-1: swap-1 type: zram size: 31.27 GiB used: 0 KiB (0.0%) priority: 100
comp: zstd avail: lzo-rle,lzo,lz4,lz4hc,deflate,842 dev: /dev/zram0
Sensors:
System Temperatures: cpu: 31.2 C mobo: 29.1 C
Fan Speeds (rpm): fan-3: 1496 fan-5: 1500
Info:
Memory: total: 32 GiB available: 31.27 GiB used: 3.41 GiB (10.9%)
Processes: 298 Power: uptime: 31m states: freeze,mem,disk suspend: deep
avail: s2idle wakeups: 0 hibernate: platform avail: shutdown, reboot,
suspend, test_resume image: 12.45 GiB services: org_kde_powerdevil,
power-profiles-daemon, upowerd Init: systemd v: 257 default: graphical
tool: systemctl
Packages: pm: pacman pkgs: 1255 libs: 315 tools: octopi,paru Compilers:
gcc: 15.1.1 Shell: garuda-inxi (sudo) default: Bash v: 5.2.37
running-in: konsole inxi: 3.3.38
Garuda (2.7.2-1):
System install date:     2025-06-28
Last full system update: 2025-06-28 ↻
Is partially upgraded:   No
Relevant software:       snapper NetworkManager dracut(custom)
Windows dual boot:       Yes
Failed units:
╭─twistedxenos@TwistedXenos in ~ took 0s
[🔴] × sudo pacman -S garuda-bootctl-dracut
[sudo] password for twistedxenos:
resolving dependencies...
looking for conflicting packages...
:: garuda-bootctl-dracut-0.0.5-1 and garuda-dracut-support-1.1.1-1 are in conflict. Remove garuda-dracut-support? [y/N] y

Package (6)                   Old Version  New Version  Net Change  Download Size

chaotic-aur/dracut-hook-uefi               17-1           0,00 MiB       0,00 MiB
garuda-dracut-support         1.1.1-1                     0,00 MiB
extra/sbctl                                0.17-1         9,93 MiB       3,07 MiB
extra/sbsigntools                          0.9.5-3        0,17 MiB       0,05 MiB
extra/tpm2-tools                           5.7-1          1,44 MiB       0,70 MiB
garuda/garuda-bootctl-dracut               0.0.5-1        0,00 MiB       0,00 MiB

Total Download Size:    3,82 MiB
Total Installed Size:  11,54 MiB
Net Upgrade Size:      11,54 MiB

:: Proceed with installation? [Y/n] y
:: Retrieving packages...
sbsigntools-0.9.5-3-x86_64             46,5 KiB   161 KiB/s 00:00 [------------------------------------] 100%
tpm2-tools-5.7-1-x86_64               715,8 KiB  2,22 MiB/s 00:00 [------------------------------------] 100%
sbctl-0.17-1-x86_64                     3,1 MiB  6,76 MiB/s 00:00 [------------------------------------] 100%
dracut-hook-uefi-17-1-any               4,6 KiB  9,78 KiB/s 00:00 [------------------------------------] 100%
garuda-bootctl-dracut-0.0.5-1-any       3,9 KiB  8,21 KiB/s 00:00 [------------------------------------] 100%
Total (5/5)                             3,8 MiB  6,59 MiB/s 00:01 [------------------------------------] 100%
(5/5) checking keys in keyring                                     [------------------------------------] 100%
(5/5) checking package integrity                                   [------------------------------------] 100%
(5/5) loading package files                                        [------------------------------------] 100%
(5/5) checking for file conflicts                                  [------------------------------------] 100%
(6/6) checking available disk space                                [------------------------------------] 100%
:: Running pre-transaction hooks...
(1/2) Rejecting pacman transaction if running in snapshot...
(2/2) Performing snapper pre snapshots for the following configurations...
==> root: 3
:: Processing package changes...
(1/1) removing garuda-dracut-support                               [------------------------------------] 100%
(1/5) installing sbsigntools                                       [------------------------------------] 100%
(2/5) installing sbctl                                             [------------------------------------] 100%
(3/5) installing tpm2-tools                                        [------------------------------------] 100%
Optional dependencies for tpm2-tools
tpm2-abrmd: user space resource manager
(4/5) installing dracut-hook-uefi                                  [------------------------------------] 100%
(5/5) installing garuda-bootctl-dracut                             [------------------------------------] 100%
Created "/boot/efi/EFI/systemd".
Created "/boot/efi/loader".
Created "/boot/efi/loader/keys".
Created "/boot/efi/loader/entries".
Created "/boot/efi/EFI/Linux".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/boot/efi/EFI/systemd/systemd-bootx64.efi".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/boot/efi/EFI/BOOT/BOOTX64.EFI".
Random seed file /boot/efi/loader/random-seed successfully written (32 bytes).
Created EFI boot entry "Linux Boot Manager".
Created Owner UUID 14e1bfb9-2b49-407c-847d-0792efda0e01
Creating secure boot keys...✓
Secure boot keys created!
:: Running post-transaction hooks...
(1/8) Arming ConditionNeedsUpdate...
(2/8) Generating unified EFI kernel images...
:: Rebuilding all unified kernel images
Can't load key from file '/usr/share/secureboot/keys/db/db.key'
40976732067F0000:error:80000002:system library:BIO_new_file:No such file or directory:crypto/bio/bss_file.c:67:calling fopen(/usr/share/secureboot/keys/db/db.key, r)
40976732067F0000:error:10000080:BIO routines:BIO_new_file:no such file:crypto/bio/bss_file.c:75:
dracut[F]: *** Creating signed UEFI image file '/boot/efi/EFI/Linux/linux-6.15.4-zen2-1-zen-67ff8dfd3d7c4b15a1453c5b0324b2ce-rolling.efi' failed ***
error: command failed to execute correctly
(3/8) Updating linux initcpios...


!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

The kernel update failed to determine how to update initramfs.
You will need to update manually using mkinitcpio or dracut yourself or your system WILL NOT BE BOOTABLE.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Waiting 10 seconds.

(4/8) Foreign/AUR package notification
=> No foreign/AUR packages found.
(5/8) Orphaned package notification...
=> No orphans found.
(6/8) Checking for .pacnew and .pacsave files...
(7/8) Performing snapper post snapshots for the following configurations...
==> root: 4
(8/8) Syncing all file systems...

A few notes:
Garuda does not officially support dual boot.
Secure boot is officially not supported.
But both is possible.
Search here inside the forum about this.
You should you ask you if i need really secure boot → my mind → never.
And what i see, you have more issues inside your system → but this in another topic.

= reboot
Step by step (my mind) → first install garuda → reboot → use the opened garuda-gui to install your preferred software → through this your system have the current status or use the konsole - command garuda-update → reboot → install the relevant drivers
(important: you have NV190 family (Ada Lovelace) that means you need the nvidia-open-dkms driver) → reboot → then install the software what you need.

To info: in the isos from 03.08 you must handmade driver install for your gpu
with the isos from 06.26. or current make this the new garuda-hardware-tool

1 Like

If this setup wasn’t officially supported, then why does the package garuda-bootctl-dracut exist?

As for Windows dual boot, it’s installed on a separate drive, so it shouldn’t interfere with the bootloader or Secure Boot setup on Linux.

I think the real issue is that modern sbctl uses /var/lib/sbctl/keys/, while garuda-bootctl-dracut (or its hooks) is still expecting the legacy path:

/usr/share/secureboot/keys/db/db.key

Because of that mismatch, I was getting signing errors during the unified kernel image generation. I couldn’t find a better fix than simply symlinking the expected path:

sudo mkdir -p /usr/share/secureboot/keys/
sudo ln -s /var/lib/sbctl/keys/db /usr/share/secureboot/keys/db

After that, the signing step worked. However, I also get this message:

old configuration detected. Please use `sudo sbctl setup --migrate`

So maybe garuda-bootctl-dracut needs to be updated to match the current sbctl key structure, or at least handle the migration path properly?

  • secure boot is M$ stuff.
  • linux need secure boot not
  • Arch Linux = kiss = keep in simple, stupid or …simple, smart.

No one need this (secure boot) but some users don´t like it simple and for this the garuda team/devs implemented this for us user to handle this easier (my mind) and what a user does with his system, installing as more then “default” is then user decision and that
garuda linux not officially secure boot supported is a decision from the team garuda.
(logical + right decision for me)
example on my test system… i use refind not grub, i use mostly my handmade kernel (fork from znver2)–> result, if i have trouble with this, i’m on my own way.

Perhaps, but no knowledge although I also have M$ installed and use it

garuda-bootclt-dracut was a work-in-progress package set up by a developer who stepped away from the project a long time ago. It doesn’t just facilitate getting secure boot set up by the way, it replaces the GRUB bootloader with systemd-boot and makes a bunch of other major changes to the system.

The package was never in a working state, it was only added to the repo for testing or experimentation purposes and was never finished. It should be considered unmaintained. No one should install or attempt to use it.

Probably we should just drop it from the repo altogether. @dr460nf1r3, @TNE, any objections?

Even if you wanted to switch to systemd-boot and use signed UKIs, your EFI partition is way too small for that. Especially if you are sharing the partition with a Windows installation.

If you want to store UKIs on the EFI partition (or use systemd-boot, which stores all kernels and initrds here), the ESP should be at least 1GB. Maybe 2 GB depending on how many kernels you want to be able to have installed, and what modules you need (for example, since you are using Nvidia your UKIs will be humongous).

If you want to enable secure boot on an existing Garuda Linux installation, just use sbctl. See this comment, for example: Secureboot - #3 by stefanwimmer128

7 Likes

No objections whatsoever. Though I don’t get the idea of “its in the repo, it must work”.
If it is a documented feature, sure. But it is not documented anywhere to my knowledge.

4 Likes

Thanks, that makes more sense now. I’ll go ahead and set up Secure Boot using this guide. I got a bit fixated on garuda-bootctl-dracut because it felt like the more ‘correct’ or official approach, since it comes directly from the Garuda devs.

Dropped the package, thanks @TwistedXenos!

6 Likes

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.