0

I'm creating a Linux respin based on Ubuntu 20.04.1. To create the final .iso I'm running a script (no longer supported) I found called distroshare. The .iso it creates works, but there are a few things that are a bit weird:

  • When I open the .iso, everything is in uppercase 8.3 style
  • When I write to a USB using Rufus, I'm only given the Target System option of BIOS (or UEFI-CSM)
  • When I write to a USB using Rufus, I'm forced to write in dd mode
  • The system won't boot in SecureBoot mode

I've seen that if I download an official Ubuntu .iso, things are different:

  • Everything is in mixed case
  • I'm given the Target System option of BIOS or UEFI
  • I can write to a USB using ISO mode
  • Boots in SecureBoot

Not sure if these things are related but I do know that the important command in the script is:

grub-mkrescue -o "${WORK}"/live.iso "${CD}"

The output of this command looks like this:

Creating the iso
xorriso 1.5.2 : RockRidge filesystem manipulator, libburnia project.

Drive current: -outdev 'stdio:/home/distroshare/live.iso'
Media current: stdio file, overwriteable
Media status : is blank
Media summary: 0 sessions, 0 data blocks, 0 data, 11.2g free
Added to ISO image: directory '/'='/tmp/grub.PGtTeI'
xorriso : UPDATE :     574 files added in 1 seconds
Added to ISO image: directory '/'='/home/distroshare/CD'
xorriso : UPDATE :     590 files added in 1 seconds
xorriso : NOTE : Copying to System Area: 512 bytes from file '/usr/lib/grub/i386-pc/boot_hybrid.img'
libisofs: NOTE : Automatically adjusted MBR geometry to 1021/165/32
xorriso : UPDATE :  1.13% done
xorriso : UPDATE :  11.48% done
xorriso : UPDATE :  19.02% done
xorriso : UPDATE :  28.71% done, estimate finish Thu Sep 10 16:43:07 2020
xorriso : UPDATE :  38.24% done, estimate finish Thu Sep 10 16:43:08 2020
xorriso : UPDATE :  45.26% done, estimate finish Thu Sep 10 16:43:08 2020
xorriso : UPDATE :  56.44% done, estimate finish Thu Sep 10 16:43:08 2020
xorriso : UPDATE :  65.32% done, estimate finish Thu Sep 10 16:43:08 2020
xorriso : UPDATE :  74.83% done, estimate finish Thu Sep 10 16:43:08 2020
xorriso : UPDATE :  83.64% done, estimate finish Thu Sep 10 16:43:08 2020
xorriso : UPDATE :  92.53% done
ISO image produced: 1346790 sectors
Written to medium : 1346790 sectors at LBA 0
Writing to 'stdio:/home/distroshare/live.iso' completed successfully. 

Do I need to use different switches for grub-mkrescue? Should I be using grub-mkimage instead? Does any of this make any sense?

EDIT: More info after Thomas's comments

I tried the -J switch and it works perfectly. I was confused since it really isn't a grub-mkrescue switch but rather a xorriso one that gets passed through.

I'm still really confused about the whole EFI/SecureBoot issue. My current iso has a file in the root called efi.img. I'm really not sure how it got there other than I've installed grub-efi-amd64-signed. Since it said it was signed and I know that Ubuntu products are trusted by SecureBoot, I thought it would work, but it doesn't.

Can I simply copy the /EFI/BOOT directory out of the Ubuntu iso and put it into the root of my iso before the md5 sum is calculated? Or should I be doing something else to get that /EFI directory?

2
  • I do not grasp the advantages of a "respin" or the procedure. Why not simply install to the USB drive?
    – Hermann
    Sep 10 '20 at 22:33
  • @Hermann What I'm trying to do is create a customized version of LInux, make an .iso from it and then let people download the .iso. They can then write this iso to their own USB drive and boot off of it. The respin aspect allows us to do wide distribution. Sep 10 '20 at 22:53
1

When I open the .iso, everything is in uppercase 8.3 style

If this happens on MS-Windows then probably due to the lack of a Joliet tree in the ISO. Add option -J to grub-mkrescue to get it.

On Linux and other Unix-like systems, you should see the original file names due to the Rock Ridge data in the ISO.

When I write to a USB using Rufus, I'm forced to write in dd mode

That's probably because Rufus does not recognize the BIOS boot equipment from GRUB. Consider to ask at Rufus support for an explanation and maybe even improvement.

The system won't boot in SecureBoot mode

This would need a boot program that was signed by Microsoft Inc. Ubuntu went through that procedure. (I count 46 occurences of the word "Microsoft" in /EFI/BOOT/BOOTX64.EFI of the EFI partition of ubuntu-19.04-desktop-amd64.iso.)

Possibly you can sign the program yourself and tell your EFI to accept your signature. But that's out of my scope, i fear.

Should I be using grub-mkimage instead?

Rather not. grub-mkrescue uses grub-mkimage to create the EFI partition. In general grub-mkrescue is the tool which GRUB advises for making an ISO with GRUB boot equipment.

Have a nice day :)

Thomas

4
  • Hey Thomas, thanks for the response, it is excellent information. I've edited my question with some followups. Sep 11 '20 at 15:04
  • 1
    The problem is that you need to get the signed "shim" into the FAT filesystem image which grub-mkrescue creates and populates and then lets xorriso advertise as EFI System Partition. That FAT image file has the name "efi.img". Next problem is that it is hardly secure if everybody is allowed to use the signed shim for starting arbitrary systems. So expect mistrust by firmware towards whatever you do. Consider to ask at help-grub@gnu.org. Sep 11 '20 at 20:45
  • So maybe I had a real misunderstanding. What I'm trying to do is package my application along with Ubuntu and create an iso from it. My application could certainly contain malware, but I thought that SecureBoot was about protecting things at the boot level not at the application level. Everything that my iso will boot is 100% Ubuntu so I assumed that I'd simply benefit from their signed code. But you're saying no, I must get my code signed (which I assume is a long and expensive process). Is this correct? Sep 12 '20 at 15:18
  • wiki.ubuntu.com/UEFI/SecureBoot obviously contains more info than i could contibute myself. It seems that the need for signing ends at the borderline between kernel and userland. So maybe you can indeed ride piggyback on Ubuntu. But i guess you have better chances if you start with an Ubuntu ISO and go along wiki.debian.org/… , rather than using grub-mkrescue. Sep 12 '20 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.