Secure Boot and the install USB

If you wrote the WebGen Linux ISO to a USB stick and the machine ignored it and booted straight back into Windows, this page is why — and it is a two‑minute fix in your firmware settings.

The symptom is silence. Firmware with Secure Boot enabled refuses to run an unsigned boot loader, and most firmware does this without showing any message at all. The machine simply carries on to the next boot device. It looks exactly like a USB stick that was written incorrectly or was not detected, which is the misleading part.

Why it happens

Your firmware holds a list of certificates it is willing to execute code from. In practice that list contains Microsoft's certificate authority and very little else. WebGen Linux builds GRUB (its boot loader) from source, and nothing signs the result — so from the firmware's point of view it is unrecognised code, and it declines to run it.

This is Secure Boot working as designed. It is not a fault in the download, and it is not a fault in the machine.

The ISO is fine. The same stick that a Secure Boot machine ignores will boot normally once Secure Boot is switched off, and boots without complaint on machines that ship with it disabled. If you want to satisfy yourself before changing any firmware settings, verify the download against its published .sha256 file.

What to do

Turn Secure Boot off, install WebGen Linux, and leave it off. The steps differ by manufacturer, and unhelpfully the setting is rarely on the first screen you land on.

HP (measured on an HP Pavilion 15)

Power the machine off completely — not sleep, and not a Windows "shut down" with fast startup still enabled.
Power on and immediately tap Esc to reach the startup menu.
Press F10 for BIOS Setup.
Go to Security → Secure Boot Configuration.
Set Secure Boot to Disabled.
HP will ask you to set a BIOS administrator password before it will accept the change. This is normal, and you will need to remember it.
Save and exit. On the next boot HP shows a four‑digit code that you must type in to confirm the change. Type it and press Enter.
Boot the USB stick — F9 at power‑on brings up the boot device menu.

Step 7 catches people out: the code appears once, on a mostly blank screen, and if you power the machine off instead of typing it the change is discarded.

Other manufacturers

These follow the same shape but we have not measured them ourselves, so treat the key presses as a starting point rather than gospel.

Make	Firmware key	Where the setting usually lives
Dell	F2	Boot Configuration, or Security → Secure Boot → Secure Boot Enable
Lenovo	F1 (ThinkPad), F2 or Novo button (IdeaPad)	Security → Secure Boot
Acer	F2	Boot → Secure Boot. Often greyed out until you set a supervisor password under Security
ASUS	F2 or Del	Advanced Mode (F7) → Boot → Secure Boot → OS Type → Other OS
MSI / Gigabyte	Del	Settings → Advanced → Windows OS Configuration, or BIOS → Secure Boot

Two patterns worth knowing, because they account for most "the option is there but I cannot change it" reports:

The setting is greyed out until an administrator/supervisor password is set. Several vendors require this, on the reasonable grounds that otherwise anyone who can reach the keyboard could turn the protection off.
Fast startup keeps the machine from truly powering down. If tapping the firmware key never gets you anywhere, hold Shift while choosing Restart in Windows, or disable fast startup, then try again.

If you cannot turn it off

Some machines — commonly corporate or education laptops — have Secure Boot locked by policy, and there is no way around that from our side. On those machines WebGen Linux cannot currently be booted from USB. We would rather say so plainly than have you spend an evening on it.

Is turning it off a bad idea?

It is a real reduction in protection, and worth being honest about rather than waving away. Secure Boot's job is to stop something malicious replacing your boot loader; with it off, that check is not happening — for every operating system on the machine, not just this one.

For a machine you own, that you are deliberately installing an operating system on, most people consider this an acceptable trade, and it is the same step every from‑source distribution asks for. If it is not an acceptable trade for you, that is a completely reasonable place to stop.

The long-term fix is a boot loader signed through Microsoft's process (via shim, the small signed first-stage loader the large distributions use). That is a review-and-signing process measured in weeks rather than an engineering problem, and WebGen Linux has not gone through it.

What this does not affect

Installing, dual‑booting, and the boot loader all work normally once Secure Boot is off.
A machine already running WebGen Linux is unaffected — this only ever bites at first boot from removable media.
Nothing about the package repository or the .deb builds is involved.
Your existing Windows or Linux installation is untouched by changing this setting; it is a firmware policy, not a change to any disk.

Found something on this page that does not match your machine? Send it to us with the Bug Submit app, or through the feedback link — per‑vendor detail is exactly the sort of thing we cannot verify alone.