# Ventoy multi-boot USB reference

Researched 2026-06-06 after HP Secure Boot issue ("USB failed to authenticate") with direct SystemRescue USB.

## Overview

Ventoy (77.1k GitHub stars, GPLv3) is a bootable USB platform. Install once, drop ISOs onto the data partition, pick from a menu at boot. Supports BIOS + UEFI + ARM64 + MIPS64. Tested with 1400+ ISOs.

**Why it matters for rescue USBs:** SystemRescue's EFI bootloader isn't Microsoft-signed, so HP/Dell/Lenovo machines with Secure Boot reject it with "USB failed to authenticate" or similar. Ventoy's Shim bootloader IS signed, and enrollment is a one-time MOK key prompt.

## Vendor Secure Boot behavior

| Vendor | Secure Boot behavior with unsigned EFI | Ventoy fix |
|---|---|---|
| **HP** | "USB failed to authenticate" — hard block, no bypass | MOK enrollment |
| **Dell** | "Invalid signature detected" — can add exception | MOK enrollment |
| **Lenovo** | "Boot device not found" — confusing error | MOK enrollment |
| **ASUS** | "Secure Boot violation" — prompts to disable | MOK enrollment |

## Download URLs

- GitHub releases: https://github.com/ventoy/Ventoy/releases
- Latest (2026-04-23): v1.1.12
- Linux tarball: `https://github.com/ventoy/Ventoy/releases/download/v1.1.12/ventoy-1.1.12-linux.tar.gz`
- Website: https://www.ventoy.net/en/index.html

## Quick install

```bash
# Requires 1GB+ USB stick
wget https://github.com/ventoy/Ventoy/releases/download/v1.1.12/ventoy-1.1.12-linux.tar.gz
tar xzf ventoy-1.1.12-linux.tar.gz
cd ventoy-1.1.12
sudo bash Ventoy2Disk.sh -i /dev/sdX    # -i = install, -I = force, -g = GPT, -s = secure boot
```

## Ventoy2Disk.sh options

| Flag | Effect |
|---|---|
| `-i /dev/sdX` | Install Ventoy (MBR, non-destructive to data partition) |
| `-I /dev/sdX` | Force install (wipes entire disk) |
| `-g /dev/sdX` | Use GPT partition table instead of MBR |
| `-s /dev/sdX` | Enable Secure Boot support (embeds Shim) |
| `-L /dev/sdX` | Use large FAT32 (default is exFAT) |
| `-r /dev/sdX` | Resume from existing install (keep data) |

## Data partition

After installation, the USB has a data partition (exFAT by default) where you drop ISO files. Label varies by version.

Plug in USB after install → copy ISO files:
```bash
cp /path/to/systemrescue-13.01-amd64.iso /media/Ventoy/
cp /path/to/other-recovery.iso /media/Ventoy/
sync
```

## Ventoy plugins

Plugins are configured via `ventoy/ventoy.json` on the data partition's root.

### Boot conf replace (recommended for SSH auto-config)

Replaces the ISO's default boot parameters:

```json
{
    "boot_conf_replace": [
        {
            "iso": "/systemrescue-13.01-amd64.iso",
            "replace": {
                "APPEND": "archisobasedir=sysresccd archisolabel=RESCUE1301 rootpass=rescue2026 nofirewall"
            }
        }
    ]
}
```

### Persistence

```json
{
    "persistence": [
        {
            "image": "/systemrescue-13.01-amd64.iso",
            "backend": "/persist/rescue.img",
            "size": 4096
        }
    ]
}
```

Create the backing file: `dd if=/dev/zero of=/mnt/Ventoy/persist/rescue.img bs=1M count=4096 && mkfs.ext4 /mnt/Ventoy/persist/rescue.img`

### Injection plugin

Injects files into the runtime environment. Place a tar.gz at `ventoy/injection/<iso-filename>/`:

```
ventoy/injection/systemrescue-13.01-amd64.iso/sysrescue.tar.gz
  └── sysrescue/sysrescue.yml  (injected into root fs)
```

## Tested ISO compatibility

SystemRescue 13.01 is Ventoy-compatible (tested). Most Linux live ISOs work. Windows install ISOs work. See the full list: https://www.ventoy.net/en/isolist.html

## VentoyPlugson (GUI plugin editor)

Ventoy includes a web-based plugin editor. Run from the extracted directory:
```bash
sudo bash VentoyPlugson.sh /dev/sdX
```
Opens a web UI at http://127.0.0.1:24681 for editing ventoy.json visually.