We have the same issue since the last update of Grub (Feb. 1st). Unsigned Kernels won’t boot if secure boot is enabled. It ends with a message saying invalid signature, you must load the kernel first. Requires a cold shutdown.
You have 2 choices:
- You disable secure boot permanently in the BIOS (worst option)
- You disable secure boot temporally on startup with MOK manager
MokManager
sudo mokutil --disable-validation
root password
mok password: 12345678
mok password: 12345678
sudo reboot
The machine will reboot in a blue screen, the MOK manager menu.. Type the number(s) shown, if its 7, it is the 7th character of the password. So, keep 12345678. The question to answer is Yes to disable secure boot. Reboot.
You’ll see on startup after a new message (top left) saying <<Booting in insecure mode>>. The machine will boot normally after and secure boot remains enabled.
This change is permanent, a clean install of Ten won't overwrite it. You must keep it that way.
To re-enable it:
sudo mokutil --enable-validation
root password
mok password: 12345678
mok password: 12345678
sudo reboot
Tumbleweed offers an option that doesn’t work in Ubuntu: Enroll Key and hash to the boot loader. Our computer is not dual boot and the bug is also present in Mint 19.1.
We made a modification to boot in the Grub menu for 5 seconds, since left shift key does not work here, nor any other combination of keys. This tweak works fine in LVM.
GRUB_DEFAULT=0
GRUB_TIMEOUT_STYLE=false
GRUB_TIMEOUT=
https://www.rodsbooks.com/refind/secureboot.html
http://www.rodsbooks.com/efi-bootloaders/secureboot.html#add_keys
mokutil --sb-state
SecureBoot enabled
4.19.5-041905: Unsigned and default
sudo apt-get purge linux-headers-4.19.5-041905 linux-headers-4.19.5-041905-generic linux-image-4.19.5-041905-generic linux-modules-4.19.5-041905-generic
4.15.0-29
sudo apt-get purge linux-headers-4.15.0-29 linux-headers-4.15.0-29-generic linux-image-4.15.0-29-generic
4.15.0-39 + 42
sudo apt-get remove --purge $(sudo dpkg -l | grep "^rc" | awk '{print $2}' | tr '\n' ' ')
The first command gave me following message/error:
dpkg: error: need an action option
Type dpkg --help for help about installing and deinstalling packages
[*]; Use 'apt' or 'aptitude' for user-friendly package management;
Type dpkg -Dhelp for a list of dpkg debug flag values; Type dpkg
--force-help for a list of forcing options; Type dpkg-deb --help for help about manipulating *.deb files;
Options marked [*] produce a lot of output - pipe it through 'less' or
'more' !
What is the reading now:
dpkg --list | grep linux-image
- rc linux-image-4.15.0-39-generic 4.15.0-39.42 amd64 Signed kernel image generic
- rc linux-image-4.15.0-42-generic 4.15.0-42.45 amd64 Signed kernel image generic
- ii linux-image-4.15.0-43-generic 4.15.0-43.46 amd64 Signed kernel image generic
- ii linux-image-4.15.0-45-generic 4.15.0-45.48 amd64 Signed kernel image generic
- ic linux-image-unsigned-4.19.5-041905-generic 4.19.5-041905.201812031110 amd64 Linux kernel image for version 4.19.5 on 64 bit x86 SMP
There is a conflict with 4.19.5,(only the config files are installed). You did not install 4.19 properly. Re-install 4.19.5 and uninstall it after.
Get the 2 generic headers + modules generic + image generic there:
https://kernel.ubuntu.com/~kernel-ppa/mainline/?C=N;O=D
Then make sure there is no deb files in the Downloads folder and run this:
cd //home/**your user name**/Downloads
sudo dpkg -i *.deb
Reboot
