mjhjmtu

I am trying to make a bootable USB drive that will work on both BIOS and UEFI systems. I tried following the steps from here:

UEFI + BIOS bootable live Debian stretch amd64 with persistence

https://wiki.gentoo.org/wiki/GRUB2#Partitioning_for_UEFI_with_GPT

The high-level process which I understood as what could work is:

1. partition drive with a vfat (fat 32) partition




2. place kernel and initramfs on that partition, path SHOULD be /efi/boot.



3. kernel SHOULD be suffixed with .efi


4. use efibootmgr to create an entry in the UEFI firmware

OR

1. partition drive with a vfat (fat 32) partition


2. install grub so motherboard invokes grub


3. grub loads as it would normally

I should also note that I tried mirroring the Ubuntu USB image as it works both both MBR and UEFI. I can tell that it is using the GRUB bootloader, version 2.02, so I'd expect it to be following option #2 as well.

Now, the first option was seen by my motherboard (and with efibootmgr); however, with option #2, it wasn't seen.

I would prefer to use option #2 so I don't have to add a boot entry for each system I boot. Also, I'd like to enable secure boot if possible.

But, I'm unable to get either approach working.

EDIT #1: I am able to get the drive booting with SecureBoot off if I use refind. However, I cannot actually get refind to boot the kernel as it complains of file not found. I specified the volume GUID # and the path of the kernel and init. Originally, I put the kernel and init inside the same directory as where the refind efi file was, then the root directory on the ESP.

EDIT #2: I tried many combinations for the refind configuration. I noticed that refind has an ext4 driver, so I created an ext4 partition, but the kernel and init there, but still no go. I also tried putting both the kernel and init at various paths inside the ESP, still no go.

What makes Ubuntu boot up with SecureBoot enabled? I want to be doing the same.