package grub-efi-amd64 2.02-2ubuntu8.3 failed to install/upgrade: installed grub-efi-amd64 package post-installation script subprocess returned error exit status 1

[JBF]

Upgrade from 16.04 LTS to 8.04 LTS failed :-(

ProblemType: Package
DistroRelease: Ubuntu 18.04
Package: grub-efi-amd64 2.02-2ubuntu8.3
ProcVersionSignature: Ubuntu 4.4.0-133.159-generic 4.4.134
Uname: Linux 4.4.0-133-generic x86_64
ApportVersion: 2.20.9-0ubuntu7.3
Architecture: amd64
Date: Wed Aug 15 15:52:35 2018
ErrorMessage: installed grub-efi-amd64 package post-installation script subprocess returned error exit status 1
InstallationDate: Installed on 2017-04-13 (488 days ago)
InstallationMedia: Ubuntu 16.04.1 LTS "Xenial Xerus" - Release amd64 (20160719)
ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.4.0-133-generic.efi.signed root=UUID=b040ddb1-ff19-4a2f-9990-cd62901eb7d7 ro quiet splash vt.handoff=7
Python3Details: /usr/bin/python3.6, Python 3.6.5, python3-minimal, 3.6.5-3ubuntu1
PythonDetails: /usr/bin/python2.7, Python 2.7.15rc1, python-minimal, 2.7.15~rc1-1
RelatedPackageVersions:
 dpkg 1.19.0.5ubuntu2
 apt 1.6.3
SourcePackage: grub2
Title: package grub-efi-amd64 2.02-2ubuntu8.3 failed to install/upgrade: installed grub-efi-amd64 package post-installation script subprocess returned error exit status 1
UpgradeStatus: Upgraded to bionic on 2018-08-15 (0 days ago)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Paul Norris (paul-norbealun)]

Secure boot is enabled in firmware. Installation script won't upgrade grub until signed kernels are available. I will disable secure boot and retry upgrade.

[Paul Norris (paul-norbealun)]

I didn't get a chance to try with secure boot disabled because the upgrade ran the recovery. I will disable secure boot and try again.

Earlier message in full from earlier in installation:

Your system has UEFI Secure Boot enabled in firmware, and the following kernels present on your system are unsigned:
 4.4.0-133-generic
These kernels cannot be verified under Secure Boot. To ensure your system remains bootable, GRUB will not be upgraded on your disk until these kernels are removed or replaced with signed kernels.

[Paul Norris (paul-norbealun)]

Recovery didn't complete either, and left the system booting to text screen. No graphics, no Unity. I recovered with:

sudo apt --fix-broken install
sudo apt update
sudo apt upgrade
sudo apt dist-upgrade
sudo apt autoremove

Made no change to Secure Boot setting.

System is good. Using it now.

[Julian Andres Klode (juliank)]

The error message is precisely there to prevent you from shooting yourself in the foot and rebooting the system without a signed kernel installed, as that won't boot (anymore).

[JBF (jbf-faure)]

So not sure if the error message is correct or enough clear. Indeed my PC rebooted without problem because the new kernel 4.15 is signed. Only some old kernels from 16.04 (4.4) was not signed and upgrade from 16.04 to 18.04 did not remove these obsolete kernels. I removed all 4.4 kernels after reboot without subsequent problem.

Best regards. JBF