Upgrade from 16.04 to 18.04 failed

Question

A notification came up:

Cannot upgrade secure boot enforcement policy due to unsigned kernels
Your system has UEFI secure boot enabled firmware, and the following kernels present on your system are unsigned:
4.4.0-134-generic
The kernels cannot be verified under secure boot. To ensure your system remains bootable, GRUB will not be upgraded on your disk until these kernels are removed or replaced with signed kernels.

and the upgrade has stopped. Can someone please tell me what to do?

Solution 1

You could turn off secure boot in your BIOS/UEFI Settings and let the unsigned packages upgrade, or install the linux-signed-generic, shim-signed, grub-efi-amd64-signed, and fwupdate-signed on your 16.04 system and upgrade with secure boot.

---

The upgrade should work if you turn off secure boot and try again. To install the packages, start a terminal (Ctrl + Alt + t ) and type:

sudo apt-get install  linux-signed-generic shim-signed grub-efi-amd64-signed fwupdate-signed

Solution 2

Running uname -r should state 18.04 after a reboot. If reboot fails, go into recovery mode and repair install (dpkg) then boot normally.

After booting, install linux-generic which should install the latest (4.15) kernel Reboot and at the grub menu, select advanced and boot into the 4.15 kernel. Then run sudo apt-get install linux-signed-generic shim-signed grub-efi-amd64-signed fwupdate-signed - which should now install without errors

Then sudo apt update && sudo apt upgrade and you should be good to go.

Comments

[c.m.williams]

Thank you very much. Can you please tell me how to install the linux-signed-generic, shim-signed, grub-efi-amd64-signed, and fwupdate-signed, or direct me to a page which will give me the information. Thanks again for answering.

[c.m.williams]

ps.. if I reboot my system now and change the bios setting will the upgrade still work ?

[c.m.williams]

Hey, thank you, "ubfan1" I followed your advice and changed the bios setting and the upgrade went through, everything is working just fine. Thanks again for your advice, much appreciated.

[ubfan1]

You can click on the accept answer icon and that marks this as solved.

[doraemon]

You answer helps, Thanks. After disabling secure boot and restart and then install the packages you presented, the upgrade finishes. Now can I enable security boot again or I should keep it disabled in order to use ubuntu 18

[ubfan1]

@lui-sha Easy to just enable it and see. Problems range from having proprietary drivers (Nvidia...), to vendor requirements for specific names on the bootloaders. Search this site for solutions to those problems if you want.

[Hosh Sadiq]

Sorry to revive an old thread - Do I disable UEFI, then install those packages and re-enable it? Or do I have to keep UEFI disabled?

[ubfan1]

@hosh-sadiq UEFI remains on at all times. Secure boot would have to be off to boot an unsigned kernel, or a signed kernel with unsigned drivers for hardware like Nvidia video.

[Hosh Sadiq]

Aah! So the only way to get rid of that warning is to actually sign the kernel? Okay! Thanks.