Package:       shim* (shim-signed, shim-signed-common,
shim-helpers-amd64-signed, shim-unsigned)
Version:        1.36~1
Platform:      amd64

Dear Maintainer,

I'm using Secure Boot for an AMD64 system and I have installed the
non-free nvidia graphics driver (nvidia-driver). To use Secure Boot, I
have to sign the additional NVidia modules manually with the following
steps:

1) create a self-signed certificate using openssl  -> I have got the key
file <hostname>.der

2) sign all module files with the script: /lib/modules/<kernel
version>/build/scripts/sign-file

3) import the key with the command: mokutil --import <hostname>.der

4) Reboot the system and enroll the key after entering the passphrase

These steps works fine for me, but after upgrading to Debian 10.10 it
does no longer work, the kernel cannot start the NVidia driver, and the
error log says, that the kernel cannot find a trusted key. After running
the command "mokutil --list-enrolled" I have got the message "MokListRT
is empty."  Then I have installed an older Debian Version 10.2 with the
older package shim-signed, Version: 1.33+15153313, an now I can see the
imported key using the command mokutil --list-enrolled.

As Workaround I have installed the older Debian Version 10.2 and have
upgraded to 10.10 except the packages for shim, then I have installed
the nvidia driver and then signed the NVidia module files and now I can
boot into a graphical Desktop.

Best regards,
Christian

Dear Maintainer,

I can confirm this issue - after upgrade on 21.06.2021, Secure Boot no
longer works. Signing the third party kernel modules reports no
problems, but the signed modules are not loaded on boot. Issue appears
to be that the MOK isnot available during and/or after boot.

host:/# mokutil --list-enrolled

MokListRT is empty


Using mokutil to reinstall the MOK works in that the correct user key is
visible in the EFI utility during the next restart, but after boot the
output of mokutil --list-enrolled is unchanged (MokListRT is empty). 
Booting an older kernel (which was working without problem prior to the
upgrade) does not change the behaviour on boot. This indicates to me
that the problem is not related to module signing.

Downgrading shim by downloading the relevant packages from
snapshot.debian.org and rolling back results in a system where the MOK
is correctly listed by mokutil --list-enrolled:


host:/# apt-get install shim-signed=1.33+15+1533136590.3beb971-7
shim-signed-common=1.33+15+1533136590.3beb971-7
shim-unsigned=15+1533136590.3beb971-7+deb10u1
shim-helpers-amd64-signed=1+15+1533136590.3beb971+7+deb10u1


After this downgrade, the nvidia driver modules were loaded on next
boot. The virtualbox modules could only be loaded after re-signing with
the MOK. Once this has been done, the system boots normally on
subsequent restarts.  Following the same procedure and updating from
version 1.33 to version 1.34 showed the same behaviour as for 1.36 -
mokutil --list-enrolled reported an empty list.


Best regards,

Gareth

Dear Maintainer,

I confirm this issue. After upgrade to Debian 10.10 (including a new
version shim-signed), Secure Boot no longer works.

I proceeded as usual :

   - I added my key via command
     # mokutil --import my-key.der

   - I rebooted

   - I obtained shim screen to propose enroll my key. It's done

But, after boot, list of enrolled key is empty.
# mokutil --list-enrolled

MokListRT is empty

Ek het hierdie sakegeleentheid -voorstel vir u wat ons sal baat; Ek sal ook
daarvan hou dat jy dit sien.

Groete,
Frank William
64 980 4011

I can also confirm this bug with shim 1.38.

Dear Maintainer,

I can also confirm the bug with shim 1.38 right after it was published and
installed. I have opened another bug that seems very similar: #999746. It
might therefore be a duplicate -- sorry if it is.

Regards,
Paul.

Hi,

Has there been any progress towards fixing this? Looking at the changelogs, I
haven't seen anything mentioning the current ticket, nor any update for some
time. Just trying to see if I can update my shim installation without breaking
my machine again.

Thanks in advance,
Paul.