For years, we have delivered our Debian USB Complete Collection (and Developer collection) with the ability to boot into a GRUB (Grand Unified Boot Loader) menu, with options to do a complete install, run any of the 9 live environments, or perform other advanced options matching the Debian install media. Since first created with Debian 10, we do install and deliver it with a EFI partition, but it was brought to our attention by a customer that there were some configuration issues that prevented it from properly booting in certain secure environments. So thanks to K.H., we have taken the time to address as many limitations as possible and this outlines specific updates to the Debian 13.7.0 Complete Collection on USB release.

First, it is important to understand there are constantly new users to the Linux world, and one of the hindrances for Linux adoption has been the rumours that Linux is too difficult to use. So when choosing how to deliver these Debian USBs, we have to maximize the types of systems that can boot a delivered USB. So the choice boils down to how to format and create the USB. The 2 main options are to use MBR (Master Boot Record) legacy approach, or the EFI recommended GPT (GUID Partition Table) partition approach. (GUID = Globally Unique IDentifier)

If the GPT approach is used, older systems will simply not boot from the USB, as their system approach (i.e BIOS/Basic Input Output System) will not boot a USB so configured. Now imagine you get your LinuxCollections.com Debian Complete Collection on USB, you plug it in, turn on your system, and... Nothing happens. At all. It just sits there. And then you find out you can't even use it on your system. From a customer satisfaction point of view, this is classified as "Not a good idea".

So the first constraint is to deliver the Debian USB with a legacy MBR partition. The consensus for EFI refers to this setup as follows: "Yes, EFI can technically work with non-GPT (such as MBR/ms-dos) partition tables in Linux, but it is rare, quirky, and not officially mandated or recommended." So we have always suggested to customers to boot in a legacy/non-secure or Compatibility Secure Module (CSM) mode enabled. However, in reviewing the feedback from K.H. and spending the time to re-configure the EFI setup and GRUB settings, we have been able to update the current Debian USB so (if the system allows it) the option to boot in a secure environment is supported (i.e. CSM Disabled).

Note that there is viable option to convert the USB to a GPT partition is possible (but not necessarily recommended) for systems that won't support the MBR/EFI boot approach. The reason is that this is not recommended is because it will change the structure of the USB and overwrite the original MBR, potentially making the USB inoperable. There are ways to backup the MBR, and install/remove the GPT partition structure, but this is a fairly advanced approach, especially for new Linux users.

Here are the updates/changes that are relevant, with some notes:

Partition 1 / EFI Partition - the /EFI/BOOT directory has a modified grub.cfg that uses the filesystem UUID for the 2nd partition (named USB_BOOT) where the main GRUB menu resides. It has been modified to handle video and graphic modules, load the menu background image and set menu color scheme, determine whether booting from MBR or GPT, and loading the appropriate grub configuration file to reflect naming differences between the different partition schemes. The BOOTX64.EFI is a renamed file of shimx64.efi.signed, and mmx64.efi is renamed file mmx64.efi.signed from the /usr/lib/shim folder (after installing the shim-signed package for Debian). The shimx64.efi.signed is actually signed by Microsoft (using the Microsoft Corporation UEFI CA 2011 certificate embedded in your motherboard's UEFI firmware). For some Linux purists, this is seen as a bad idea, and better to use the non-signed legacy approach. The mmx64.efi.signed is a secondary piece for Machine Owner Keys (MOK) and signed by Debian, as well as the grubx64.efi which is the actual GRUB code.

GPT / gdisk notes:

To modify a USB to GPT, you need to use gdisk (apt install gdisk), then simply run gdisk with the USB device i.e. gdisk /dev/sdb, then follow prompts and change to GPT.

Steps to convert USB (MBR => GPT):
1. Backup MBR dd if=/dev/sdb of=/path/to/backup/mbr_backup.img bs=512 count=1
2. Run gdisk and create GPT gdisk /dev/sdb

Steps to convert USB (GPT => MBR):
1. Run gdisk and remove GPT gdisk /dev/sdb

Once inside the interactive gdisk prompt, use these options:
A. Type x and press Enter to go into the expert menu.
B. Type z and press Enter to zap the GPT data.
C. Type N (No) when asked if you want to blank out the MBR.
D. Type Y (Yes) to confirm you want to proceed.