[RESOLVED] this pops up when using dist-upgrade

[Clayman1000x]

I'm not sure what is going on here but could someone give a better explanation of what this means. How to get rid of unsigned kernel.:

"Cannot upgrade Secure Boot enforcement policy due to unsigned kernels │
│ │
│ Your system has UEFI Secure Boot enabled in firmware, and the following kernels present on your system are unsigned: │
│ │
│ 5.15.0-051500rc6-generic │
│ │
│ │
│ These kernels cannot be verified under Secure Boot. To ensure your system remains bootable, GRUB will not be upgraded on your disk │
│ until these kernels are removed or replaced with signed kernels."

[kc1di]

The warning means that those kernels are not signed to work with UEFI boot. If you want to use those kernels you would have to change to Legacy mode in your bios.

Or you will have to remove those kernels from your install. In order to upgrade grub.

[Clayman1000x]

The warning means that those kernels are not signed to work with UEFI boot. If you want to use those kernels you would have to change to Legacy mode in your bios.

Or you will have to remove those kernels from you install. In order to upgrade grub.

I get that, I could understand that part, but how do I fix it? I don't want/need those kernels. I believe I installed those kernels to try and upgrade the kernel to use the new wireless wifi standard in this new laptop. when I bought this laptop the wifi and bluetooth didn't work until a new kernel15. something.

[kc1di]

I get that, I could understand that part, but how do I fix it? I don't want/need those kernels. I believe I installed those kernels to try and upgrade the kernel to use the new wireless wifi standard in this new laptop. when I bought this laptop the wifi and bluetooth didn't work until a new kernel15. something.

you can remove them with these commands. in a terminal.

First this one will tell you the kernel in use

uname -r

2. This one will tell you what kernels are installed

sudo dpkg --list | egrep 'linux-image|linux-headers'

3. This one should remove those not being used.

sudo apt autoremove --purge

Good luck.

[claydoh]

The quickest way would be to use Muon or Synaptic to search for items with that name.
But be exact, as the current 20.04 official kernel is a version of the 5.15, and the package name/version will be easier to spot: linux-image-5.15.0-48 or similar.
You want to keep those.
You can also search for and remove any linux-headers packages that match the exact version of the kernel(s) you are removing


Using Secure Boot is not usually mandatory, unless it is required by workplace rules, so it *can* be disabled, so you would not see the warnings.

Another useful thing to do is to see if there are any stray packages that can be removed, for some cleanup, which may include some old kernels versions as well,. Usually the 3 most recent updates or so are kept
In Muon, go to Edit >> Remove Unnecessary Packages. There is a similar option in Synaptic iirc.
This is the same as running sudo apt autoremove on the command line if you aren't doing this sort of thing somewhat regularly already.
This will not remove any kernels you have manually installed, so you would still need to go in and manually find and uninstall those you have specifically added yourself.

[Clayman1000x]

Cannot upgrade Secure Boot enforcement policy due to unsigned kernels │
│ │
│ Your system has UEFI Secure Boot enabled in firmware, and the following kernels present on your system are unsigned: │
│ │
│ 5.15.0-051500rc6-generic │
│ │
│ │
│ These kernels cannot be verified under Secure Boot. To ensure your system remains bootable, GRUB will not be upgraded on your disk │
│ until these kernels are removed or replaced with signed kernels.

This is what I get when I run "sudo apt autoremove" or "
sudo apt autoremove --purge".

clayman1000x@clayman1000x-ASUS:~$ sudo dpkg --list | egrep 'linux-image|linux-headers'
[sudo] password for clayman1000x:
ii linux-headers-5.13.0-35-generic 5.13.0-35.40~20.04.1 amd64 Linux kernel headers for version 5.13
.0 on 64 bit x86 SMP
ii linux-headers-5.13.0-41-generic 5.13.0-41.46~20.04.1 amd64 Linux kernel headers for version 5.13
.0 on 64 bit x86 SMP
ii linux-headers-5.15.0-051500rc6 5.15.0-051500rc6.202110180730 all Header files related to Linux kernel
version 5.15.0
ii linux-headers-5.15.0-41-generic 5.15.0-41.44~20.04.1 amd64 Linux kernel headers for version 5.15
.0 on 64 bit x86 SMP
ii linux-headers-5.15.0-43-generic 5.15.0-43.46~20.04.1 amd64 Linux kernel headers for version 5.15
.0 on 64 bit x86 SMP
ii linux-headers-5.15.0-45-generic 5.15.0-45.48~20.04.1 amd64 Linux kernel headers for version 5.15
.0 on 64 bit x86 SMP
ii linux-headers-5.15.0-46-generic 5.15.0-46.49~20.04.2 amd64 Linux kernel headers for version 5.15
.0 on 64 bit x86 SMP
ii linux-headers-5.15.0-48-generic 5.15.0-48.54~20.04.1 amd64 Linux kernel headers for version 5.15
.0 on 64 bit x86 SMP
ii linux-headers-5.15.0-50-generic 5.15.0-50.56~20.04.1 amd64 Linux kernel headers for version 5.15
.0 on 64 bit x86 SMP
ii linux-headers-5.15.0-52-generic 5.15.0-52.58~20.04.1 amd64 Linux kernel headers for version 5.15
.0 on 64 bit x86 SMP
ii linux-headers-5.15.0-53-generic 5.15.0-53.59~20.04.1 amd64 Linux kernel headers for version 5.15
.0 on 64 bit x86 SMP
ii linux-headers-generic-hwe-20.04 5.15.0.53.59~20.04.21 amd64 Generic Linux kernel headers
rc linux-image-5.13.0-30-generic 5.13.0-30.33~20.04.1 amd64 Signed kernel image generic
ii linux-image-5.13.0-35-generic 5.13.0-35.40~20.04.1 amd64 Signed kernel image generic
rc linux-image-5.13.0-37-generic 5.13.0-37.42~20.04.1 amd64 Signed kernel image generic
rc linux-image-5.13.0-41-generic 5.13.0-41.46~20.04.1 amd64 Signed kernel image generic
ii linux-image-5.15.0-41-generic 5.15.0-41.44~20.04.1 amd64 Signed kernel image generic
ii linux-image-5.15.0-43-generic 5.15.0-43.46~20.04.1 amd64 Signed kernel image generic
ii linux-image-5.15.0-45-generic 5.15.0-45.48~20.04.1 amd64 Signed kernel image generic
ii linux-image-5.15.0-46-generic 5.15.0-46.49~20.04.2 amd64 Signed kernel image generic
ii linux-image-5.15.0-48-generic 5.15.0-48.54~20.04.1 amd64 Signed kernel image generic
ii linux-image-5.15.0-50-generic 5.15.0-50.56~20.04.1 amd64 Signed kernel image generic
ii linux-image-5.15.0-52-generic 5.15.0-52.58~20.04.1 amd64 Signed kernel image generic
ii linux-image-5.15.0-53-generic 5.15.0-53.59~20.04.1 amd64 Signed kernel image generic
rc linux-image-5.8.0-43-generic 5.8.0-43.49~20.04.1 amd64 Signed kernel image generic
ii linux-image-generic-hwe-20.04 5.15.0.53.59~20.04.21 amd64 Generic Linux kernel image
ii linux-image-unsigned-5.15.0-051500rc6-generic 5.15.0-051500rc6.202110180730 amd64 Linux kernel image for version 5.15.0
on 64 bit x86 SMP

The unsigned one is the part I need removed but nothing gets rid of it. This also messes with my updater, not letting me update grub.

[jlittle]

Please, do you need secure boot?

(IMO it causes problems for no benefit to normal users.)

[claydoh]

The unsigned one is the part I need removed but nothing gets rid of it. This also messes with my updater, not letting me update grub.

More details are needed here. What do these mean, exactly, with specifics?

You need to uninstall the specific kernel package after making sure you are not booted using that kernel version (as described previously)
sudo apt remove linux-image-unsigned-5.15.0-051500rc6-generic
Or use Muon or Synaptic

Please, do you need secure boot?

(IMO it causes problems for no benefit to normal users.)

I agree 1001% here It does nothing but get in the way for those who dual boot.
I believe even Win 11 has ways around the Secure boot 'requirement'.

[Clayman1000x]

Thanks claydoh, this last command did the trick. What happened was, this is a newer laptop, 2021. The wireless wifi and Bluetooth card, same card, did not have drivers in linux yet until a certain kernel was installed, 15.???, I forget which one exactly. The wifi started to work after my first update with a wired connection but bluetooth would not, and bluetooth is needed at work. So I tried to install the correct kernel and it worked as far as getting the Bluetooth to work, but left me in an unsigned kernel situation which I just fixed I hope. I haven't rebooted yet so I will see.

[Clayman1000x]

Everything seems good today, updates with no issue relating to kernel so I will mark this as solved. Seems someone already posted "resolved". ok, thanks for the help.