Your kernels are unsigned. This system will fail to boot in a secure boot environment

Question

I've installed the mainline kernel 4.18 from here http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.18/ using ubuntu 18.04

The packages are unsigned and now grub is complaining about it at each update.

E: Your kernels are unsigned. This system will fail to boot in a secure boot environment.

How can I make the message go away? Or get some 4.18 signed?

I am not looking into building my own kernel.

Solution 1

I ended reverting to the default kernel from ubuntu and it all workend as expected.

Solution 2

My process for removing the unsigned kernel (forgot I had installed it?):

$ uname -r
4.17.2-041702-generic

‍

$ ls /boot/
abi-4.15.0-23-generic             memtest86+.elf
abi-4.15.0-34-generic             memtest86+_multiboot.bin
abi-4.17.2-041702-generic         retpoline-4.15.0-23-generic
config-4.15.0-23-generic          retpoline-4.15.0-34-generic
config-4.15.0-34-generic          retpoline-4.17.2-041702-generic
config-4.17.2-041702-generic      System.map-4.15.0-23-generic
efi                               System.map-4.15.0-34-generic
grub                              System.map-4.17.2-041702-generic
initrd.img-4.15.0-23-generic      vmlinuz-4.15.0-23-generic
initrd.img-4.15.0-34-generic      vmlinuz-4.15.0-34-generic
initrd.img-4.17.2-041702-generic  vmlinuz-4.17.2-041702-generic
memtest86+.bin

‍

$ dpkg -S /boot/vmlinuz-4.17.2-041702-generic
linux-image-unsigned-4.17.2-041702-generic: /boot/vmlinuz-4.17.2-041702-generic

‍

$ dpkg --list | grep 4.17.2
ii  linux-headers-4.17.2-041702                4.17.2-041702.201806160433                 all          Header files related to Linux kernel version 4.17.2
ii  linux-image-unsigned-4.17.2-041702-generic 4.17.2-041702.201806160433                 amd64        Linux kernel image for version 4.17.2 on 64 bit x86 SMP
ii  linux-modules-4.17.2-041702-generic        4.17.2-041702.201806160433                 amd64        Linux kernel extra modules for version 4.17.2 on 64 bit x86 SMP

‍

$ dpkg --list | grep 4.17.2 | awk '{print $2}'
linux-headers-4.17.2-041702
linux-image-unsigned-4.17.2-041702-generic
linux-modules-4.17.2-041702-generic

‍

$ sudo apt-get purge $(dpkg --list | grep 4.17.2 | awk '{print $2}')
[sudo] password for alex:
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be REMOVED:
linux-headers-4.17.2-041702* linux-image-unsigned-4.17.2-041702-generic*
linux-modules-4.17.2-041702-generic*
0 upgraded, 0 newly installed, 3 to remove and 0 not upgraded.
2 not fully installed or removed.
After this operation, 308 MB disk space will be freed.
Do you want to continue? [Y/n] y
(Reading database ... 203507 files and directories currently installed.)
Removing linux-headers-4.17.2-041702 (4.17.2-041702.201806160433) ...
Removing linux-image-unsigned-4.17.2-041702-generic (4.17.2-041702.201806160433) ...
W: Removing the running kernel
I: /vmlinuz.old is now a symlink to boot/vmlinuz-4.15.0-23-generic
I: /initrd.img.old is now a symlink to boot/initrd.img-4.15.0-23-generic
/etc/kernel/postrm.d/initramfs-tools:
update-initramfs: Deleting /boot/initrd.img-4.17.2-041702-generic

Comments

[Calin]

I don't want to build my own kernel.

[Panther]

Signing process is the same with mainline kernel and the mainline kernel is unsupported

[Boris Hamanov]

Besides that this isn't a supported configuration, try turning off secure boot in your BIOS.