Build a Universal EFI Binary with grub-glue-efi

Apple firmware wants one binary carrying both architectures, and grub-glue-efi welds a 32-bit and a 64-bit EFI image into it. This guide uses grub-glue-efi from grub-common version 2.12-1ubuntu7.3, installed on Ubuntu here. Allow about 15 minutes if both input images already exist; building the input images is a separate task requiring the matching GRUB platform files.

The command only combines files. It does not install a bootloader, copy anything to an EFI System Partition, sign an image, or prove that either input can boot. Keep the result in a working directory until you have tested it on the firmware and boot path you actually support.

1. Confirm the command and its version

Start with the read-only checks below:

$ command -v grub-glue-efi
/usr/bin/grub-glue-efi
$ grub-glue-efi --version
grub-glue-efi (GRUB) 2.12-1ubuntu7.3
$ dpkg-query -W -f='${Package} ${Version}\n' grub-common
grub-common 2.12-1ubuntu7.3

2. Gather one image for each architecture

grub-glue-efi expects an ia32 EFI image for --input32 and an amd64 EFI image for --input64. They are not two copies of the same file. Check their paths, sizes and machine types before combining them:

$ file /path/to/grub-i386.efi /path/to/grub-x86_64.efi
/path/to/grub-i386.efi:   PE32 executable (EFI application) Intel 80386
/path/to/grub-x86_64.efi: PE32+ executable (EFI application) x86-64
$ test -s /path/to/grub-i386.efi && test -s /path/to/grub-x86_64.efi
$ printf '%s\n' "$?"
0

The wording from file can vary slightly between versions, but the distinction that matters is PE32 versus PE32+, and 32-bit Intel versus x86-64. A zero status from test -s only says that both files are non-empty; it does not validate GRUB headers or bootability.

If you are creating the images with grub-mkimage, use these platform pairs:

• 32-bit image. -O i386-efi with the /usr/lib/grub/i386-efi platform directory.
• 64-bit image. -O x86_64-efi with the /usr/lib/grub/x86_64-efi platform directory.

grub-mkimage -p /boot/grub \
  -O i386-efi \
  -d /usr/lib/grub/i386-efi \
  -o /path/to/grub-i386.efi \
  boot

grub-mkimage -p /boot/grub \
  -O x86_64-efi \
  -d /usr/lib/grub/x86_64-efi \
  -o /path/to/grub-x86_64.efi \
  boot

Those platform directories and the modules available in them depend on installed packages. Do not substitute the x86-64 directory for the 32-bit one. On this machine the amd64 platform directory is present while the 32-bit directory is not, so the first example above is a template rather than a command that can succeed locally without the matching files.

3. Combine the two images into a new file

Choose an output path that is not either input path. The command overwrites an existing output file, so check it before running the write:

input32=/path/to/grub-i386.efi
input64=/path/to/grub-x86_64.efi
output=/path/to/grub-universal.efi

if test -e "$output"; then
    printf 'Refusing to overwrite existing output: %s\n' "$output" >&2
    exit 1
fi

grub-glue-efi \
  --input32="$input32" \
  --input64="$input64" \
  --output="$output"

There is no need for sudo when the files are in a directory you can write. Use elevated privileges only if your chosen path is deliberately protected, and review that path first: writing into a mounted EFI System Partition is a separate, security-sensitive deployment action, not the first test to run.

$ test -s /path/to/grub-universal.efi
$ printf '%s\n' "$?"
0
$ file /path/to/grub-universal.efi
/path/to/grub-universal.efi: Universal EFI binary with 2 architectures, i386, x86_64

The file result is a useful format check, but it does not replace boot testing. If the command fails, preserve the error text and inspect every input path: a missing file, an unreadable file or a typo in an option can look like a build problem when it is only a path problem.

4. Use verbose output when you need a trace

Add --verbose when you want a short confirmation on standard error, and keep binary output in a file by using --output:

$ grub-glue-efi --verbose \
    --input32=/path/to/grub-i386.efi \
    --input64=/path/to/grub-x86_64.efi \
    --output=/path/to/grub-universal.efi
/path/to/grub-universal.efi: Universal EFI binary with 2 architectures, i386, x86_64

The output option defaults to standard output. That is useful for a controlled pipeline, but it is easy to corrupt an EFI binary by mixing diagnostics or other text into the same stream. For routine work, always name an output file and redirect logs separately if you need to retain them.

5. Check the result before deployment

Compare the architecture report with the two inputs, then retain hashes if the file will be copied between systems:

file /path/to/grub-i386.efi \
     /path/to/grub-x86_64.efi \
     /path/to/grub-universal.efi
sha256sum /path/to/grub-universal.efi

A universal result is a container for both architectures, not a guarantee that firmware will choose the desired slice or that the embedded GRUB configuration is correct. Test it in the intended Apple or other firmware environment, and apply your normal Secure Boot signing and verification process where required. Do not assume that combining unsigned inputs creates a signed output.

output=/path/to/grub-universal.efi
test -f "$output" && printf 'Review before removing: %s\n' "$output"
# After that review, remove the generated file with your normal change control.

The input images are not modified by grub-glue-efi. Keep them if you need to reproduce the result.