GRUB
GRUB can be added to SeaBIOS as a floppy image to provide a reliable bootloader stored in the CBFS. GRUB can be used to verify kernel/initrd integrity and/or to support encrypted /boot partitions.
It is also possible to create a bootable GRUB USB stick, if you for some reason do not want to flash into CBFS.
GRUB on USB stick
If you want to boot an encrypted /boot partition the quickest way is to create a bootable GRUB USB stick. If LUKS2 is used, which commonly use argon2 for KDF, this requires at least GRUB 2.14 (modules: luks2, argon2).
Create bootable GRUB USB stick
# Basic example of bootable GRUB disk with LUKS support (not LUKS2 if you don't include modules such as luks2 and argon2 below) grub-mkrescue -o grub.img --compress=xz --locale-directory=/usr/share/locale --locales=en@quot --fonts=none --modules="normal part_gpt part_msdos luks cryptodisk gcry_sha256 gcry_sha512 gcry_rijndael gcry_twofish pbkdf2" dd if=grub.img of=/dev/sdX
Include the modules you need in the above command, available modules can generally be seen here:
ls /usr/lib/grub/i386-pc/
Boot the USB stick
It is more convenient to modify a grub.cfg to automatically boot your system. However in this simple example, you will need to boot the GRUB USB stick and then manually choose your system grub.cfg (or alternatively skip loading the 'real' grub.cfg on disk, and instead correctly point it to your rootfs path, kernel, and initramfs), on each boot.
Here is an example:
# Decrypt disk cryptomount -a # Find correct path ls # Set / for convenience root=(lvm/matrix-bootvol) # Boot the real GRUB config on disk to boot your system configfile /boot/grub.cfg
Build GRUB for LUKS2
If you want LUKS2 support and do not have GRUB >= 2.14, compile it as shown here.
# Instructions for Ubuntu 24 or Debian 13. # I had issues on Debian 13 with an error "Gold bug?" upon running the grub-mkrescue binary. It however did work on Debian 12 and Ubuntu 24.04. # # Replace "user" with your system username! sudo apt install -y build-essential git autoconf automake libtool bison flex gettext texinfo pkg-config help2man libgcrypt20-dev libdevmapper-dev liblzma-dev libzstd-dev libpcre2-dev libtasn1-6-dev autopoint autoconf-archive gawk mtools xorriso git clone https://git.savannah.gnu.org/git/grub.git cd grub # Checkout latest stable tag, currently is 2.14 (2026-01) git checkout grub-2.14 #use gawk not mawk which may be default on your system export AWK=/usr/bin/gawk ./bootstrap ./configure --with-crypto=libgcrypto --prefix=/home/user/_0_my-grub make -j$(nproc) make install # To /home/user/_0_my-grub (as set with 'prefix' in ./configure above) # Create a bootable image "grub.img" # note: add the modules you need, all these modules are generally not required /home/user/_0_my-grub/bin/grub-mkrescue -o grub.img --compress=xz --locale-directory=/usr/share/locale --directory=/home/user/_0_my-grub/lib/grub/i386-pc --locales=en@quot --fonts=none --modules="normal part_gpt part_msdos luks cryptodisk gcry_sha256 gcry_sha512 gcry_arcfour gcry_blowfish gcry_camellia gcry_cast5 gcry_crc gcry_des gcry_dsa gcry_idea gcry_md4 gcry_md5 gcry_rfc2268 gcry_rijndael gcry_rmd160 gcry_rsa gcry_seed gcry_serpent gcry_sha1 gcry_tiger gcry_twofish gcry_rijndael gcry_twofish pbkdf2 luks2 lvm zfs pbkdf2 password password_pbkdf2 random crypto cryptodisk gcry_blake2 argon2" # Finally write to USB stick dd if=grub.img of=/dev/sdX
Verifying /boot
Prepare your GRUB image
If you have GPG signed files in /boot, GRUB can verify them each boot to prevent tampering.
Dependencies
apt install xorriso
file layout
Organize your files like this:
./generate.sh ./fdroot ./fdroot/boot/ ./fdroot/boot/grub ./fdroot/boot/grub/grub.cfg ./fdroot/boot/grub/boot.key
grub.cfg
Review your systems current grub.cfg (/boot/grub/grub.cfg) to find your root UUID and other information you may need. You will need to load all necessary modules before loading your GPG key. Here is an example grub.cfg used on Debian 13.
insmod part_gpt
insmod crypto
insmod cryptodisk
insmod geli
insmod ufs2
insmod search
insmod search_label
insmod usb_keyboard
insmod echo
insmod ls
insmod cat
insmod test
insmod configfile
insmod bsd
insmod reboot
insmod pbkdf2
insmod password
insmod password_pbkdf2
insmod gcry_rsa
insmod gcry_sha512
insmod gcry_rijndael
insmod verifiers
insmod play
insmod part_msdos
insmod mdraid1x
insmod lvm
insmod ext2
insmod diskfilter
insmod gzio
insmod ntfs
insmod linux
insmod drivemap
insmod chain
insmod loopback
trust /boot/grub/boot.key
set timeout_style=menu
set timeout=5
play 480 440 1
menuentry 'Debian GNU/Linux (signed)' {
set check_signatures=enforce
search --no-floppy --fs-uuid --set=root xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
echo 'Loading Linux ...'
linux /boot/latest/vmlinuz root=UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ro
echo 'Loading initial ramdisk ...'
initrd /boot/latest/initrd.img
}
menuentry 'Debian GNU/Linux (unsigned)' {
set check_signatures=no
search --no-floppy --fs-uuid --set=root xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
echo 'Loading Linux ...'
linux /boot/latest/vmlinuz root=UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ro
echo 'Loading initial ramdisk ...'
initrd /boot/latest/initrd.img
}
boot.key
This is the public key used to verify your files
generate.sh
#!/bin/bash
GRUB_MODULES+="usb_keyboard ls echo cat search_label search configfile part_gpt geli ufs2 cryptodisk gcry_rijndael bsd reboot pbkdf2 password password_pbkdf2 gcry_rsa gcry_sha512 test play verifiers"
GRUB_MODULES+=" part_msdos mdraid1x lvm ext2 diskfilter gzio ntfs linux drivemap chain part_acorn part_amiga part_apple part_bsd part_dfly part_dvh part_plan part_sun part_sunpc crypto loopback"
rm -f grub.img
grub-mkrescue --compress=gz -o grub.img --locale-directory=/usr/share/locale --locales=en@quot --fonts=none --install-modules="${GRUB_MODULES}" ./fdroot || exit
FDLEN=2949120
if [ $(stat -c %s "grub.img") -gt $FDLEN ]; then
echo "Generated GRUB image is too large for a 2.88MB floppy image. Please adjust script."
rm grub.img
exit 1;
fi
truncate -s $FDLEN grub.img
grub.img
Create your grub floppy image
chmod +x generate.sh ./generate.sh
Add your GRUB image to coreboot
In your coreboot compilation directory, add grub.img and create the bootorder file
bootorder
/rom@floppyimg/grub HALT
Attach grub.img and bootorder to coreboot
./build/cbfstool ./build/coreboot.rom add -f grub.img -n floppyimg/grub.lzma -t raw -c lzma ./build/cbfstool ./build/coreboot.rom add -f bootorder -n bootorder -t raw