ggRock Secure Boot shim chain

Replace ggRock's stock ipxe.efi PXE path with a shimx64 → grubx64 chain compatible with stock Microsoft factory keys.
No sidecar files needed — the wrapper downloads everything.

Boot chain (before → after)
firmware → ipxe.efi becomes firmware → shimx64.efi → grubx64.efi → iPXE → Windows

Quick start

Two oneliners — install and revert. Both download from the hosted bundle, run in a temp directory, and clean up after themselves.

Install

wget -O - https://images.ggleap.com/ManagedServices/Scripts/shim-bundle/install.sh | bash -

Revert

wget -O - https://images.ggleap.com/ManagedServices/Scripts/shim-bundle/revert.sh | bash -

What the wrapper does

1. Creates a temp directory and registers a cleanup trap — nothing is left on disk after exit.
2. Downloads all five bundle files from images.ggleap.com: install-shim-chain.sh, shimx64.efi, mmx64.efi, grubx64.efi, and MOK.cer.
3. Runs install-shim-chain.sh, which verifies the MOK fingerprint, stages binaries in /var/lib/tftp/, patches /etc/dnsmasq.d/pxe.conf, and restarts dnsmasq.
4. Temp directory is removed automatically on exit. The revert wrapper only downloads the installer script — EFI sidecars are not needed for undo.

Before you run: BIOS requirements

On each client machine before deploying:

1. Enter BIOS → Secure Boot settings.
2. Set Secure Boot mode to Standard (sometimes labelled Setup or Factory).
3. Use Restore Factory Keys (or equivalent) to load the default Microsoft keys into db/dbx.
4. Save and exit. The machine is now ready to enroll the MOK via MokManager on first PXE boot.

Post-install steps

Step 1 — disable Secure boot keys auto enrollment

In the ggRock UI: Settings → Secure boot → Secure boot keys auto enrollment → toggle OFF

Step 2 — enroll the MOK on each client (one-time)

1. Copy MOK.cer to a FAT-formatted USB stick.
2. On first PXE boot, MokManager will appear automatically.
3. Select Enroll key from disk, navigate to MOK.cer, and confirm.
   
4. Verify the SHA-256 fingerprint shown on screen matches the expected value before accepting.

Step 3 — validate

Reboot the client and confirm the full chain: firmware → shim → grubx64.efi → iPXE → Windows.

In PowerShell on the booted client:

Confirm-SecureBootUEFI

Should return True.

Hosted bundle

All files are served from https://images.ggleap.com/ManagedServices/Scripts/shim-bundle/

Reverting

Run the revert oneliner. It restores the original dnsmasq config and removes the shim/grub/MOK binaries from TFTP.

wget -O - https://images.ggleap.com/ManagedServices/Scripts/shim-bundle/revert.sh | bash -

Restoring ggRock custom certificates after revert

If your ggRock setup uses custom Secure Boot certificates (rather than the Microsoft factory keys), restore them after reverting:

1. Enter BIOS on each client → Secure Boot settings.
2. Delete all Secure Boot keys (clears db, dbx, KEK, PK — puts firmware into Setup mode).
3. In the ggRock UI, re-enable Secure boot keys auto enrollment (Settings → Secure boot → toggle ON).
4. PXE boot the client — ggRock will re-enroll its custom certificates via LockDown.efi automatically.

Troubleshooting