[SOLVED] Must Disable Secure Boot in ASUS BIOS Kubuntu 25.04 USB OS (not live)

[CharlesBazaar]

I used the latest 25.04 live to create a bootable Kubutu system. Both were USB sticks (live + new). Was slow (naturally) but it completed successfully. Booted afterwards to verify. selecting the stick from the BIOS menu. A standard Grub menu appeared and selected the the default Kubuntu entry. Played about a bit, all seemed fine, then properly shut down the system.

The next day, tried to boot from the new Kubuntu disk. Grub appeared after selecting the new stick from BIOS. i selected the top default entry to boot Kumbutu. Almost immediately a shim_?? error occurred saying the kernel must be loaded first.

After considerable research i disabled secure boot in BIOS and whoola, it booted and all is good.

Since this was a normal desktop installation without errors, creating a new OS on a new USB stick, I didn't expect any problems. Obviously it was successful but somehow the secure boot signatures were not created properly,

Question: What did I do wrong? Can it easily be fixed? Would prefer to keep everything stock with secure boot while I test this new distro.

Thanks
Mes

mes@ASUS:~$ inxi -F
System:
  Host: kumbtu-x540up Kernel: 6.14.0-15-generic arch: x86_64 bits: 64
  Desktop: KDE Plasma v: 6.3.4 Distro: Kubuntu 25.04 (Plucky Puffin)
Machine:
  Type: Laptop System: ASUSTeK product: X540UP v: 1.0
    serial: <superuser required>
  Mobo: ASUSTeK model: X540UP v: 1.0 serial: <superuser required>
    UEFI: American Megatrends v: X540UP.316 date: 10/28/2021
Battery:
  ID-1: BAT0 charge: 19.4 Wh (99.0%) condition: 19.6/24.8 Wh (79.1%)
    volts: 11.2 min: 11.2
CPU:
  Info: dual core model: Intel Core i5-7200U bits: 64 type: MT MCP cache:
    L2: 512 KiB
  Speed (MHz): avg: 400 min/max: 400/3100 cores: 1: 400 2: 400 3: 400 4: 400
Graphics:
  Device-1: Intel HD Graphics 620 driver: i915 v: kernel
  Device-2: Advanced Micro Devices [AMD/ATI] Sun LE [Radeon HD 8550M / R5
    M230] driver: radeon v: kernel
  Device-3: Goertek USB2.0 VGA UVC WebCam driver: uvcvideo type: USB
  Display: wayland server: X.org v: 1.21.1.16 with: Xwayland v: 24.1.6
    compositor: kwin_wayland driver: gpu: i915 resolution: 1920x1080~60Hz
  API: EGL v: 1.5 drivers: iris,radeonsi,swrast
    platforms: gbm,wayland,x11,surfaceless,device
  API: OpenGL v: 4.6 compat-v: 4.5 vendor: intel mesa v: 25.0.3-1ubuntu2
    renderer: Mesa Intel HD Graphics 620 (KBL GT2)
  API: Vulkan v: 1.4.304 drivers: N/A surfaces: xcb,xlib,wayland
  Info: Tools: api: clinfo, eglinfo, glxinfo, vulkaninfo
    de: kscreen-console,kscreen-doctor wl: wayland-info x11: xdriinfo,
    xdpyinfo, xprop, xrandr
Audio:
  Device-1: Intel Sunrise Point-LP HD Audio driver: snd_hda_intel
  API: ALSA v: k6.14.0-15-generic status: kernel-api
  Server-1: PipeWire v: 1.2.7 status: active
Network:
  Device-1: Realtek RTL810xE PCI Express Fast Ethernet driver: r8169
  IF: enp2s0f2 state: down mac: 70:4d:7b:97:0b:94
  Device-2: Qualcomm Atheros QCA9565 / AR9565 Wireless Network Adapter
    driver: ath9k
  IF: wlp3s0 state: down mac: 3c:a0:67:3b:a1:ce
  Device-3: Realtek RTL8153 Gigabit Ethernet Adapter driver: r8152 type: USB
  IF: enx00e04c19a4e2 state: up speed: 1000 Mbps duplex: full
    mac: 00:e0:4c:19:a4:e2
Bluetooth:
  Device-1: Lite-On driver: btusb type: USB
  Report: hciconfig ID: hci0 state: up address: 3C:A0:67:3B:D9:96 bt-v: 4.0
Drives:
  Local Storage: total: 1.85 TiB used: 8.23 GiB (0.4%)
  ID-1: /dev/sda vendor: Samsung model: SSD 870 EVO 2TB size: 1.82 TiB
  ID-2: /dev/sdb vendor: Kingston model: DT microDuo 3C size: 29.31 GiB
    type: USB
Partition:
  ID-1: / size: 28.39 GiB used: 8.22 GiB (29.0%) fs: ext4 dev: /dev/sdb2
  ID-2: /boot/efi size: 299.4 MiB used: 7.7 MiB (2.6%) fs: vfat
    dev: /dev/sdb1
Swap:
  Alert: No swap data was found.
Sensors:
  System Temperatures: cpu: 61.0 C pch: 54.0 C mobo: N/A gpu: radeon
    temp: 45.0 C
  Fan Speeds (rpm): cpu: 0
Info:
  Memory: total: 12 GiB available: 11.57 GiB used: 2.25 GiB (19.5%)
  Processes: 204 Uptime: 19m Shell: Bash inxi: 3.3.37​
mes@ASUS:~$

[skyfishgoo]

ok, i'm way confused by this post.

you mention kubuntu 25.04 but your info says ubuntu 22.04

you mention a live USB stick but you also mention installing onto a USB stick

the normal way of installing a linux os is to create a bootable USB (live) from a .iso file that you have downloaded and verified.

you then use this live USB as the install medium for a full install onto your PC hard drive

after you have installed the OS, you then remove the USB and reboot which should bring up the grub menu on your PC

save the USB stick in case you ever need to boot to a live USB session to do maintenance or repairs.

[CharlesBazaar]

Sorry to confuse. My primary sys is 22.05 LTS canocal. So I always boot from that (primary 2TB SSD). But I take advantage of USB sticks wherever possible. Obviously I ran the command from 22,05 LTS by mistake

Downloaded the live Kubunto, created the USB live media stick and booted from the live. Liked what I saw, and added a 2nd USB stick (while still in Kubunto live) and created the Kubuntu boot disk on the 2nd. Once complete, shutdown and booted from the 2nd USB stick. However, today it immediately gave a shim_?? error which lead me to disable secure boot to avoid the error.

Hope that helps

[skyfishgoo]

ah, you installed kubuntu onto a USB stick and you are trying to boot from that like was as an external drive.

not sure that is supposed to work when secure boot is enabled unless you some how sign for that external drive, otherwise it's not really "secure" is it?

also, it's not a good idea to use a USB stick in this way as they will wear out rather quickly... if you want linux on an external drive, i suggest a sabrent SSD enclosure with a crucial P310 SSD in it.

[CharlesBazaar]

Thanks for that! Makes sense. Secure Boot was a 'black box' for me It works or it doesn't. More to learn Ugh

[Qqmike]

Your Kubuntu installed to the USB stick should work OK -- with secure boot disabled.
Just be aware of what skyfishgoo says about wear-out. There are lots of reads & writes done while booted on that USB.
But ... it will last a long time. Just don't store any really important data on it unless you also backup that data somewhere else, too.
Just my 2 cents.