Shim-signed Installation Dependency Issue with Zorin 18 Core

Installing Zorin OS
1

I installed Core 18 and had issues with corrupt packages so I did a global reinstall of all packages and now I have the warnings below. Are they a problem and can they be cleared?

The background is after the initial installation everything seemed to be working but I couldn't get videos to display in browser web pages. I got a "no application or mimetype for mp4" error despite installing all files as per the instructions I found.

Giving up on that I started to install a music player (which had worked fine under 17). It just wouldn't open so I ran it from a terminal so I could see any errors. I saw it was throwing a " cannot find/access shared library XXXXXX" error. A quick file search found the file was indeed missing. I did a cross-reference check with the ubuntu reference library found what package this library was in and found that this package was already installed on my system. Hmmmm....

Did an apt reinstall package and tried again. Still wouldn't open. Ran in a terminal again and found it was complaining with same error, but different shared library. This time the file existed but obviously couldn't be loaded. Wash, rinse, repeat....... No joy but again same error, different library!!!! I had to do this 4 times. (Note I didn’t touch the player package). On the 5th attempt the player opened perfectly. Woohooo!!!

But!!! Four corrupt package installs..... This put some serious doubt as to the integrity of the installation packages so I decided to take the nuclear option of reinstalling EVERY package on my system (all 2700+ of them) in one go which I proceeded to do with:

sudo apt-get install aptitude
sudo aptitude reinstall '~i'

All went surprisingly smoothly with only one small issue (see below*) but it was a big download. The end result was that everything now seems to be working much better. Videos now display in the web browser and the music player opens without issue.

The issue was that package 'grub-efi-arm64-signed' was not found in my listed repositories so that dependency prevented 'shim-signed' from being reinstalled. I installed 'grub-efi-amd64-signed' as my research seemed to indicate that was more appropriate for my system but it failed too and won't configure. I now get the output below when doing an 'apt upgrade'. I tried to purge 'shim-signed' off the install queue but the system won't let you.

Is there anything that can be done to clear these error warnings? The system seems to boot and run just fine.

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.
Listing... Done
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
0 to upgrade, 0 to newly install, 0 to remove and 0 not to upgrade.
2 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Do you want to continue? [Y/n] 
Setting up grub-efi-amd64-signed (1.202.5+2.12-1ubuntu7.3) ...
od: /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c: Input/output error
/usr/share/grub/grub-check-signatures: 22: [: Illegal number: 
dpkg: error processing package grub-efi-amd64-signed (--configure):
 installed grub-efi-amd64-signed package post-installation script subprocess returned error exit status 255
dpkg: dependency problems prevent configuration of shim-signed:
 shim-signed depends on grub-efi-amd64-signed (>= 1.191~) | grub-efi-arm64-signed (>= 1.191~) | base-files (<< 12.3); however:
  Package grub-efi-amd64-signed is not configured yet.
  Package grub-efi-arm64-signed is not installed.
  Version of base-files on system is 13ubuntu10.3+zorin2.
 shim-signed depends on grub-efi-amd64-signed (>= 1.187.2~) | grub-efi-arm64-signed (>= 1.187.2~); however:
  Package grub-efi-amd64-signed is not configured yet.
  Package grub-efi-arm64-signed is not installed.

dpkg: error processing package shim-signed (--configure):
 dependency problems - leaving unconfigured
Errors were encountered while processing:
 grub-efi-amd64-signed
 shim-signed
E: Sub-process /usr/bin/dpkg returned an error code (1)

Thanks a million,
Reg.

2

Is Secure Boot enabled in your BIOS settings?
Are you dual booting Windows OS?

3

Hi, Thanks for looking. :slight_smile:

I am not dual booting, just have Zorin 18 Core on this machine.

I do not have secure boot enabled.
from boot log using journalctl

BIOS 7.11 04/28/2012
secureboot: Secure boot disabled

There doesn't appear to be any errors. As you can see it is quite an old BIOS and I couldn't see if it could be set at all...

Cheers,
Reg.

1 Like
4

If you are booting in EFI with Secure Boot disabled, that may cause the updater to be unable to determine Secure Boot state.
You can try enabling Secure boot temporarily, running the update, then disabling it afterward.

5

Unfortunately I don't think this will be an option with 2012 hardware... :neutral_face:

reg@reg-p6-2155a:~$ mokutil --sb-state
This system doesn't support Secure Boot

I found this reference to the same problem with a similar hardware:
https://forums.linuxmint.com/viewtopic.php?t=440005

Would this be an option?

Cheers,
Reg.

6

It sure would.

sudo apt remove --purge grub-efi-amd64-signed

sudo apt clean

7

This was the very first thing I tried. It appears it won't remove because it is not fully installed and won't clean because it is partially installed. :frowning:

I was going to live with this error but I have found that it also affects the gnome-software application which picks up this error and reports an installation failure for other apt packages.

I'll have a go at the grub repair at my link above and try apt remove again tonight when I have a bit more time.

Cheers,
Reg.

8

Yoy can try

sudo apt --fix-broken install

Then remove package or clean apt.

9

Still no luck with anything above I'm afraid. :frowning:

I'm looking suspiciously at this line in the error logs (see first post).

od: /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c: Input/output error

This file does exist but I get the same "Input/output error" when I try to view it with xxd, even with sudo. The other files in this folder are the same. Is this normal?

Cheers,
Reg.

10

So, your EFI variable file system is not accessible.
Are you able to mount the file system?

sudo mount -t efivarfs efivarfs /sys/firmware/efi/efivars

Aside, since you cannot install or remove software, caught in an apt loop:

sudo mv /var/lib/dpkg/info/shim-signed.postinst /var/lib/dpkg/info/shim-signed.postinst.bak

sudo touch /var/lib/dpkg/info/shim-signed.postinst

sudo chmod +x /var/lib/dpkg/info/shim-signed.postinst

sudo dpkg --configure -a

sudo apt -f install

11 
mount: /sys/firmware/efi/efivars: efivarfs already mounted on /sys/firmware/efi/efivars.
       dmesg(1) may have more information after failed mount system call.

What would I look for in the dmesg log?

The instructions for the apt loop made no appreciable difference with the output exactly as per the first post. :frowning:

However, everything seems to be working (except for the apt error message) so I would suggest attempting to get those packages to install on a system that doesn't support secure boot is a dead end. Is there a way to just clear the (re)install flag for those two packages in apt?

(I tried "apt-mark hold" but no joy).

Cheers,
Reg.

12

Let's try

sudo dpkg --configure -a

sudo dpkg --remove --force-remove-reinstreq shim-signed grub-efi-amd64-signed

13 
$ sudo dpkg --remove --force-remove-reinstreq shim-signed grub-efi-amd64-signed
dpkg: error processing package shim-signed (--remove):
 this is a protected package; it should not be removed
dpkg: dependency problems prevent removal of grub-efi-amd64-signed:
 shim-signed depends on grub-efi-amd64-signed (>= 1.191~) | grub-efi-arm64-signed (>= 1.191~) | base-files (<< 12.3); however:
  Package grub-efi-amd64-signed is to be removed.
  Package grub-efi-arm64-signed is not installed.
  Version of base-files on system is 13ubuntu10.3+zorin2.
 shim-signed depends on grub-efi-amd64-signed (>= 1.187.2~) | grub-efi-arm64-signed (>= 1.187.2~); however:
  Package grub-efi-amd64-signed is to be removed.
  Package grub-efi-arm64-signed is not installed.
 shim-signed depends on grub-efi-amd64-signed (>= 1.191~) | grub-efi-arm64-signed (>= 1.191~) | base-files (<< 12.3); however:
  Package grub-efi-amd64-signed is to be removed.
  Package grub-efi-arm64-signed is not installed.
  Version of base-files on system is 13ubuntu10.3+zorin2.
 shim-signed depends on grub-efi-amd64-signed (>= 1.187.2~) | grub-efi-arm64-signed (>= 1.187.2~); however:
  Package grub-efi-amd64-signed is to be removed.
  Package grub-efi-arm64-signed is not installed.

dpkg: error processing package grub-efi-amd64-signed (--remove):
 dependency problems - not removing
Errors were encountered while processing:
 shim-signed
 grub-efi-amd64-signed
14

-facepalm-
Unprotect it
sudo sed -i '/^Package: shim-signed$/,/^$/ s/^Protected: yes$/Protected: no/' /var/lib/dpkg/status
Then:

sudo dpkg --remove --force-remove-reinstreq --force-depends shim-signed

Due to the above, I want to do a little extra to make sure you have no trouble booting up.

sudo apt install --reinstall grub-efi-amd64

sudo grub-install

sudo update-grub

sudo dpkg --configure -a

sudo apt clean && sudo apt autoremove

15

This just popped up...

GRUB failed to install to the following devices:
/dev/sda1
Do you want to continue anyway? If you do, your computer may not start up properly.  
Writing GRUB to boot device failed - continue? 
<Yes>  <No>

Shall I continue?

16

Select No

What is your output for

findmnt /boot/efi

17

"No" just starts an endless loop. There is some warnings posted into the terminal but I can't read them before the requestor fills the terminal again. Something similar was noted in other readings I did.

In another terminal I got:

$ findmnt /boot/efi
TARGET    SOURCE    FSTYPE OPTIONS
/boot/efi /dev/sda1 vfat   rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro
1 Like
18

sudo grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=grub

sudo update-grub

19

Before I do that, will I break out of the "sudo apt install --reinstall grub-efi-amd64" loop with continue or just kill it (or use another terminal?)

20

The terminal in use does not create the loop, so in any terminal, you can enter the command.
The loop is currently caused by the conflict held in APT.