Verification-done on cosmic with grub2/2.02+dfsg1-5ubuntu8.2, grub2-signed/1.110.2:
Upgrading grub in the presence of an unsigned kernel (copied existing vmlinuz and ran 'sbattach --remove') leads to a failing upgrade, as expected. Despite 'mokutil --export --db' returning an error "db is empty", if all kernels present are correctly signed the upgrade completes without issues.
Verification-done on cosmic with grub2/2. 02+dfsg1- 5ubuntu8. 2, grub2-signed/ 1.110.2:
Upgrading grub in the presence of an unsigned kernel (copied existing vmlinuz and ran 'sbattach --remove') leads to a failing upgrade, as expected. Despite 'mokutil --export --db' returning an error "db is empty", if all kernels present are correctly signed the upgrade completes without issues.