#1141324 fwupdmgr: "Secure boot is enabled, but shim isn't installed to EFI/systemd/shimx64.efi" when updating firmware

Package:
fwupd
Source:
fwupd
Description:
Firmware update daemon
Submitter:
Andreas
Date:
2026-07-04 16:07:02 UTC
Severity:
normal
#1141324#5
Date:
2026-07-02 22:19:39 UTC
From:
To:
Dear Maintainer,

I am trying to update the firmware on my Lenovo X280. It errors as follows:

```
$ fwupdmgr update
╔══════════════════════════════════════════════════════════════════════════════╗
║ Upgrade System Firmware from 0.1.57 to 0.1.59?                               ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ Lenovo System Firmware Version 1.59                                          ║
║                                                                              ║
║ Important updates                                                            ║
║                                                                              ║
║ • Enhancement to address security vulnerabilities                            ║
║                                                                              ║
║ 20KES03000 must remain plugged into a power source for the duration of the   ║
║ update to avoid damage.                                                      ║
╚══════════════════════════════════════════════════════════════════════════════╝
Perform operation? [Y|n]: y
Scheduling…              [                                       ]
failed to write-firmware: Secure boot is enabled, but shim isn't installed to EFI/debian/shimx64.efi
```

Yes, shim isn't installed, on purpose as I'm using my own Secure Boot keys/certs. But I don't see how shim should be involved in an EFI capsule-based BIOS update.

Note that fwupdmgr managed to at least write the capsule to the ESP:

```
$ sudo tree /boot/efi/EFI/systemd/fw
/boot/efi/EFI/systemd/fw
├── fwupd-3b8c8162-188c-46a4-aec9-be43f1d65697.cap
└── fwupd-508f7539-1ad6-48b9-8680-38377535009d.cap

1 directory, 2 files
```

I'd expect some success message and a prompt to reboot my machine, so that the UEFI BIOS can update the BIOS.

I have installed fwupd 2.0.20-1~bpo13+1 from trixie-backports as I was told in #1112464 that the issue should be fixed there. It isn't. I was told to open a new issue about it.

Cheers,
Andreas
#1141324#10
Date:
2026-07-03 14:09:05 UTC
From:
To:
Did you set the right configuration option (DisableShimForSecureBoot)?

https://fwupd.github.io/libfwupdplugin/fwupd.conf.html#uefi_capsule-parameters
#1141324#15
Date:
2026-07-03 14:09:05 UTC
From:
To:
Did you set the right configuration option (DisableShimForSecureBoot)?

https://fwupd.github.io/libfwupdplugin/fwupd.conf.html#uefi_capsule-parameters
#1141324#20
Date:
2026-07-04 15:56:07 UTC
From:
To:
Thanks! Indeed, I had to set

```
[uefi_capsule]
DisableShimForSecureBoot=true
```

and install the `fwupd-unsigned` package, uninstall the
`fwupd-amd64-signed` package.

Then I used sbsign to sign `/usr/libexec/fwupd/efi/fwupdx64.efi`.

Another `sudo fwupdmgr update` (now without error) and a reboot later,
my Lenovo X280 was updated from firmware 1.57 to 1.59. Jippieh!
#1141324#25
Date:
2026-07-04 15:56:07 UTC
From:
To:
Thanks! Indeed, I had to set

```
[uefi_capsule]
DisableShimForSecureBoot=true
```

and install the `fwupd-unsigned` package, uninstall the
`fwupd-amd64-signed` package.

Then I used sbsign to sign `/usr/libexec/fwupd/efi/fwupdx64.efi`.

Another `sudo fwupdmgr update` (now without error) and a reboot later,
my Lenovo X280 was updated from firmware 1.57 to 1.59. Jippieh!