Boot fails after kernel upgrade from 4.15.0-20 to to 4.15.0-62 (Ubuntu Mate 18.04.3)

[Gareth Evans]

This bug affects the physical host machine, but seems to stem from virtualbox.

After apt-get dist-upgrade upgraded kernel from 4.15.0-20 to to 4.15.0-62, the machine fails to boot after restart.

The text:

PKCS#7 signature not signed with a trusted key

is repeated on 4 lines.

Different shades of "black" as background to text appear at approx 1s intervals, then whole screen goes blank, this loops for at least 2 mins.

No alternative terminals (Alt+Fx) are available.

After reinstalling OS, update/dist-upgrade, and reinstalling various software, dmesg contains the following:

$ sudo dmesg | grep signature
[sudo] password for user:
[ 1614.972768] PKCS#7 signature not signed with a trusted key
[ 1614.973013] vboxdrv: module verification failed: signature and/or required key missing - tainting kernel
[ 1615.015852] PKCS#7 signature not signed with a trusted key
[ 1615.024261] PKCS#7 signature not signed with a trusted key
[ 1615.032860] PKCS#7 signature not signed with a trusted key

There are various references to occurrences of the error apparent at boot time concerning NVIDIA drivers. I have onboard Intel graphics.

And (for future reference) is there a way to rescue a machine apparently bricked in this way?

[Bashing-om (bashing-om)]

Hekko Gareth Evans ;

the error:
"PKCS#7 signature not signed with a trusted key" is generally hardware driver related - specifically Nvidia.

What results when attempting to boot with the nomodeset boot parameter:
A common kernel (boot)parameter is nomodeset, which is needed for some graphic cards that otherwise boot into a black screen or show corrupted splash screen. See http://ubuntuforums.org/showthread.php?t=1613132
on how to use this parameter.

Once booted please verify that Nvidia graphics are at play here:
lspci -k|grep -iEA5 'vga|3d'

Chances are this issue is a failure to build the graphic's driver rather than a bug. But presently we will work this report as a bug.

-it is a process-

[Gianfranco Costamagna (costamagnagianfranco)]

you have to setup a key if you want to use signed kernel modules and bios features