We are happy to announce that RakuOS now ships with full Secure Boot support across all editions (KDE, GNOME, COSMIC) and all ISO variants (AMD/Intel and NVIDIA).
What's New
- Signed kernel and drivers — The CachyOS kernel and all custom kernel modules (xpadneo, xpad-noone, zenergy, xone, NVIDIA) are now signed with the RakuOS Secure Boot key.
- Automatic key enrollment — The installer queues the RakuOS signing key during installation. On first boot you will just need to enter the password.
- Live ISO boots with Secure Boot enabled — You no longer need to disable Secure Boot to run the installer.
- CPU compatibility check — The installer now detects and warns if your CPU does not meet the x86-64-v3 requirement (Intel Haswell 2013+ / AMD Zen 2017+) before installation begins.
Fresh Install
- Boot the ISO — Secure Boot can remain enabled in your firmware.
- Install normally through the Anaconda installer.
- On first reboot after installation a blue MOK Manager screen will appear.
- Select Enroll MOK → Continue.
- Enter the enrollment password:
rakuos - Select Reboot.
From this point forward your system will boot with Secure Boot fully active.
Enrolling the Key on an Existing Install
If you are already running RakuOS and want to enable Secure Boot, run the following command in a terminal:
rakuos enroll-secureboot-key
Then:
- Reboot your system.
- A blue MOK Manager screen will appear before the OS loads.
- Select Enroll MOK → Continue.
- Enter the enrollment password:
rakuos - Select Reboot.
- Go into your UEFI firmware settings and enable Secure Boot.
Your system will boot normally from this point with Secure Boot active.
What Gets Signed
| Component | Signed |
|---|---|
CachyOS kernel (vmlinuz) |
✓ |
| xpadneo (Xbox controller driver) | ✓ |
| xpad-noone (Xbox controller driver) | ✓ |
| zenergy (AMD energy sensor driver) | ✓ |
| xone (Xbox One wireless adapter driver) | ✓ |
| NVIDIA kernel modules | ✓ NVIDIA ISO only |
Notes
- The live ISO uses a standard signed Fedora kernel solely to boot the installer. The installed system always uses the full CachyOS kernel.
- If you experience a Secure Boot violation after a system image update, re-run
rakuos enroll-secureboot-key. This should only be necessary if the signing key ever changes. - More information and troubleshooting at rakuos.org/docs/secure-boot.