Issue:

When using encrypted /boot, the boot process fails for users with non-QWERTY keyboards. This issue arises when a user sets a passphrase for disk encryption using a keyboard layout other than American QWERTY. At boot time, the keyboard layout defaults to American, causing the entered passphrase to differ from the expected one, leading to problems in unlocking the encrypted disk.

This issue has been discussed on the issue tracker of the popular Calamares Linux installer software. [1]

Suggested Solution:

1. Modify `grub-mkimage` to by default include all keyboard layouts in the resulting GRUB core image (`grubx64.efi`).
2. Add a keyboard layout switcher to early GRUB.
3. Read the keyboard layout from EFI variables or another file.

This might need to be split into separate tickets.

Potential Issue:

Adding all keyboard layouts to the image might significantly increase the size of the core image, potentially making it too large or slow for practical use.

Alternative Solution:

Could the core image search for (signed) keyboard layout files in the EFI partition and load them?

Non-Solution:

The Arch Linux Wiki describes how a user can build a custom EFI core image (`grubx64.efi`). [2] However, this leads to issues with Secure Boot, as the image isn't signed with a key trusted by Shim.

This is not easily implementable since this issue has been unresolved since at least 2019. Distributions such as Ubuntu and PureOS (among possibly others) are reverting back to unencrypted /boot.

Not So Great Solution:

Distributions could ship multiple images, one for each keyboard layout. However, if this is the suggested approach, please specify.

EFI Specific:

Suggestions 1 and 2 are generic. Suggestion 3 is EFI specific and should therefore be optional.

Terminology:

- Early GRUB: The GRUB core image (`grubx64.efi`) just after being started by Shim or firmware, prompting for the password for the full disk encrypted (FDE) disk (including encrypted /boot). At this time, even /boot is unavailable, hence no keyboard layout files can be loaded from `/boot/grub` and there's no `/boot/grub/grub.cfg`.

References:

[1] https://github.com/calamares/calamares/issues/1203
[2] https://wiki.archlinux.org/title/GRUB/Tips_and_tricks#Manual_configuration_of_core_image_for_early_boot